ISO/IEC DIS 27004   Stage 40.60, close of voting Planning date, an estimate 14 Sep 2027 The recordFree checkKit USD 799 and watch USD 49 a month
6.1Clause
Clause 6. What, when and who to monitor and measure

General: measure to the information need

Guidance in the published 2016 editionRecord 7 of 67Updated 2026-10-21

There is no shortage of things that can be counted, and that is the problem.

What the published 2016 guidance says

There is no shortage of things that can be counted, and that is the problem. Too many measures, or the wrong ones, obscure the few signals that matter and waste the effort spent collecting them. The guidance therefore starts from purpose: decide what the organization needs to know about performance and effectiveness, turn that into explicit information needs, and only then choose the measures and the data that satisfy each need. The measure follows the question, never the other way round.

What it means in practice

Start with the decision the organisation needs to make, then derive the information need, then the measure. Measuring what the tool emits is the common shortcut and the reason measurement programmes collapse under their own reports. Fewer measures with a clear purpose survive an audit better than a large inventory.

Status of this record. For 6.1, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.

What good looks like

Keep a one-page information-needs list with the decision and the owner. Map each measure to one need. If a measure maps to none, it is a candidate for retirement, however easy it is to collect.

Evidence an assessor asks for

  • Performance evaluationA documented list of information needs
  • GovernanceA traceability from each measure to the information need it serves

The question an assessor will ask

An assessor will ask for A documented list of information needs. The test for 6.1 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.

Common gaps

  • A measurement set assembled from whatever a tool reports rather than from information needs
  • Dozens of measures with no owner able to say which decision each informs

Before the next review

Before the next review, test this against one live record: A measurement set assembled from whatever a tool reports rather than from information needs.

What to check when the revision publishes

When DIS 27004 is published, compare the 6.1 General: measure to the information need record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.