Scope, normative references, terms and definitions
The 2016 edition is a guide, not a rulebook.
What the published 2016 guidance says
The 2016 edition is a guide, not a rulebook. Its purpose is to help a team judge two things: how well security is performing, and how well the management system is working. It covers the tracking and measuring of both, plus the reading and judging of what the results mean. Any organization may use it, whatever its size or sector. It adds no new management system duty and no one is obliged to follow it. The introduction says the results can inform governance, management, operations and improvement, and that the method should fit the organization rather than the reverse. It replaced the 2009 edition and appeared in December 2016. Its bibliography points to ISO/TR 10017, ISO/IEC 15939, ISO/IEC 27000, the 2013 requirement standard and NIST SP 800-55.
What it means in practice
Read the scope before you buy any tool. The published guidance is a method for evaluating performance and effectiveness; it adds no requirement of its own. The ISMS requirement it serves is clause 9.1 of the management system standard, and the organisation still owns the choice of measures.
Status of this record. For 1-3, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Keep the scope statement and the clause 9.1 procedure together. The procedure should name the requirement standard and edition it serves, the information needs, the measures and the retention rule. A reader should be able to tell that the guidance is a method, not a new obligation.
Evidence an assessor asks for
- Performance evaluationThe clause 9.1 procedure, with the edition of the requirement standard it serves
- Performance evaluationThe scope statement and the list of information needs
The question an assessor will ask
An assessor will ask for the clause 9.1 procedure, with the edition of the requirement standard it serves. The test for 1-3 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- The procedure cites the guidance as if it created a requirement
- The edition of the requirement standard is not stated
- The retention rule for measurement results is missing
Before the next review
Before the next review, test this against one live record: the procedure cites the guidance as if it created a requirement.
What to check when the revision publishes
When DIS 27004 is published, compare the 1-3 Scope, normative references, terms and definitions record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.