ISO/IEC DIS 27004   Stage 40.60, close of voting Planning date, an estimate 14 Sep 2027 The recordFree checkKit USD 799 and watch USD 49 a month
6.4Clause
Clause 6. What, when and who to monitor and measure

When to monitor, measure, analyse and evaluate

Guidance in the published 2016 editionRecord 10 of 67Updated 2026-10-21

Timing belongs to the information need, not to a single corporate calendar.

What the published 2016 guidance says

Timing belongs to the information need, not to a single corporate calendar. Collection can be more frequent than analysis, and analysis more frequent than reporting. Enough data must accumulate before a comparison means anything, and a new process may need a test period before its measures are useful. The guidance advises setting a limit on that tuning, and deciding how long collection runs before analysis starts. Timings change when a manual source becomes automated, and a baseline is needed whenever two sets of results are compared across a change of method or period.

What it means in practice

Set the clock per information need, not one calendar for everything. Collection can be more frequent than analysis; analysis more frequent than reporting. Fix a limit on fine-tuning, decide how much data is enough for a comparison, and record the baseline when you change a method or a source.

Status of this record. For 6.4, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.

What good looks like

Set a collection frequency, an analysis frequency and a reporting frequency for each measure. Record the baseline and the minimum sample. Put a review date on the schedule and change it only with a note.

Evidence an assessor asks for

  • Performance evaluationCollection, analysis and reporting frequencies recorded per measure
  • PlanningA recorded baseline for each measure that is compared over time
  • Performance evaluationA defined end to the fine-tuning period

The question an assessor will ask

An assessor will ask for collection, analysis and reporting frequencies recorded per measure. The test for 6.4 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.

Common gaps

  • Frequencies inherited from a tool's default rather than set from the information need
  • Comparisons over time with no baseline recorded
  • Measurement programmes that never leave the fine-tuning stage

Before the next review

Before the next review, test this against one live record: frequencies inherited from a tool's default rather than set from the information need.

What to check when the revision publishes

When DIS 27004 is published, compare the 6.4 When to monitor, measure, analyse and evaluate record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.