ISO/IEC DIS 27004   Stage 40.60, close of voting Planning date, an estimate 14 Sep 2027 The recordFree checkKit USD 799 and watch USD 49 a month
6.5Clause
Clause 6. What, when and who to monitor and measure

Who will monitor, measure, analyse and evaluate

Guidance in the published 2016 editionRecord 11 of 67Updated 2026-10-21

People and roles must be named, whether the work is manual or automated.

What the published 2016 guidance says

People and roles must be named, whether the work is manual or automated. The guidance describes seven parts: the client who needs the information; the planner who designs the construct; the reviewer who confirms it is sound; the information owner who supplies the data; the collector; the analyst; and the communicator. One person may hold more than one part, but the reviewer should not be the only designer. Different parts need different skills, awareness and training, and the assignment should be written down rather than assumed from a job title.

What it means in practice

Name people, not functions alone. The guidance separates seven roles: client, planner, reviewer, information owner, collector, analyst and communicator. One person can hold several, but the reviewer should not be the only person who built the construct. Record the skills and training each role needs.

Status of this record. For 6.5, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.

What good looks like

Name a client, a planner, a reviewer, an information owner, a collector, an analyst and a communicator for the programme, even if one person holds several roles. Record the training each role needs and the deputy for each.

Evidence an assessor asks for

  • Roles and responsibilitiesEach measure's owner, collector and client named (the minimum Table 1 asks for)
  • Performance evaluationRole definitions or a responsibility matrix for planner, reviewer, analyst and communicator

The question an assessor will ask

An assessor will ask for each measure's owner, collector and client named (the minimum Table 1 asks for). The test for 6.5 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.

Common gaps

  • Measures with a collector but no client, so nobody consumes the result
  • The same person planning, reviewing and analysing with no independent validation of the construct

Before the next review

Before the next review, test this against one live record: measures with a collector but no client, so nobody consumes the result.

What to check when the revision publishes

When DIS 27004 is published, compare the 6.5 Who will monitor, measure, analyse and evaluate record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.