The need for measurement
Planning and implementing a management system does not by itself prove that the plans work.
What the published 2016 guidance says
Planning and implementing a management system does not by itself prove that the plans work. The 2013 requirement standard therefore asks for evidence that the system and its controls are delivering the objectives. Measurement is the mechanism for that evidence. The guidance frames the point plainly: an ISMS exists to protect confidentiality, integrity and availability within its scope, and the only way to know whether it is doing so is to test the result, not the intention.
What it means in practice
A plan that is never tested against its objectives is an assertion. The practical question is not whether the ISMS has controls, but whether anyone can show that the controls and the processes are producing the intended result. If the only evidence of performance is an audit finding, the organisation is measuring late.
Status of this record. For 5.1, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Write one sentence for each objective saying how its achievement will be evaluated. If the sentence needs a measure that does not exist, that is the first gap. Keep the sentence with the objective, not in a separate measurement policy.
Evidence an assessor asks for
- GovernanceISMS objectives and the statement of how their achievement is evaluated
- Performance evaluationEvidence that the 9.1 evaluation requirement is assigned and resourced
The question an assessor will ask
An assessor will ask for ISMS objectives and the statement of how their achievement is evaluated. The test for 5.1 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- An ISMS that plans and implements controls with no defined way of telling whether the objectives are being met
- Measurement treated as a certification formality rather than the check on whether the plans work
Before the next review
Before the next review, test this against one live record: an ISMS that plans and implements controls with no defined way of telling whether the objectives are being met.
What to check when the revision publishes
When DIS 27004 is published, compare the 5.1 The need for measurement record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.