ISO/IEC DIS 27004   Stage 40.60, close of voting Planning date, an estimate 14 Sep 2027 The recordFree checkKit USD 799 and watch USD 49 a month
4Section
Introduction and structure

Structure and overview

Introduction in the published 2016 guidanceRecord 2 of 67Updated 2026-10-21

The guidance is arranged in four movements.

What the published 2016 guidance says

The guidance is arranged in four movements. Clause 5 gives the reasons to measure. Clause 6 covers the choices: what to watch, what to measure, how often, and who does the work. Clause 7 separates measures of activity from measures of effect. Clause 8 sets out the operating steps. The order follows a simple logic: start with the question the organization needs answered, design the measure, gather the data, analyse it, then judge the result against the question. Annex A supplies a measurement model, Annex B supplies worked examples on a common template, and Annex C shows a free-form alternative.

What it means in practice

The order in the guidance is the order of a defensible programme: information need, measure, data, analysis, evaluation. Teams that start with a dashboard reverse it and end up reporting numbers nobody asked for. Use the figure as a design check, not as a template to fill in.

Status of this record. For 4, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.

What good looks like

Draw the chain once, with the organisation's own labels, and put the name of the owner beside each step. If a step has no owner, the programme will stop there. Review the drawing when the measure set changes.

Evidence an assessor asks for

  • Performance evaluationA one-page map from information need to measure, data, analysis and evaluation
  • Performance evaluationThe name of the owner for each step in the map

The question an assessor will ask

An assessor will ask for A one-page map from information need to measure, data, analysis and evaluation. The test for 4 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.

Common gaps

  • The measure set starts with a dashboard and works backwards to no information need
  • No one can say which step of the chain owns a missing output
  • The guide is treated as a template to fill in rather than a design check

Before the next review

Before the next review, test this against one live record: the measure set starts with a dashboard and works backwards to no information need.

What to check when the revision publishes

When DIS 27004 is published, compare the 4 Structure and overview record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.