What to measure
Measurement assigns a value, a status or a trend to performance or effectiveness so that improvement needs become visible.
What the published 2016 guidance says
Measurement assigns a value, a status or a trend to performance or effectiveness so that improvement needs become visible. It can be applied to a process, an activity, a control or a group of controls. The same requirement can be measured two ways: training can be counted by attendance, while retained competence can be tested after the course. Some clauses explicitly require effectiveness to be established, which presupposes a defined question and a measure. For a control, useful attributes include how far it cuts likelihood or impact, how much it can take before failing, and how quickly it spots an event.
What it means in practice
Measure the process and the control, not only the outcome. Training can be counted by attendance and tested by a post-course exercise; both answer different questions. For a control, ask how far it reduces likelihood or consequence, how much it can absorb before failing, and how quickly it detects an event.
Status of this record. For 6.3, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
For each control in scope, choose one performance measure and one effectiveness measure where possible. Write the formula so that a different person could repeat it. Test the measure on one control before extending it to the set.
Evidence an assessor asks for
- Performance evaluationMeasures defined for the clauses that require effectiveness to be determined (corrective action, competence, awareness)
- Control effectivenessControl measures expressed as likelihood reduction, consequence reduction, capacity or detection time
The question an assessor will ask
An assessor will ask for measures defined for the clauses that require effectiveness to be determined (corrective action, competence, awareness). The test for 6.3 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- Corrective-action effectiveness reviewed with no measure ever defined for it
- Controls measured only for whether they exist, never for what they do to risk
Before the next review
Before the next review, test this against one live record: corrective-action effectiveness reviewed with no measure ever defined for it.
What to check when the revision publishes
When DIS 27004 is published, compare the 6.3 What to measure record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.