General: performance measures and effectiveness measures
Two kinds of measure do different work.
What the published 2016 guidance says
Two kinds of measure do different work. A performance measure describes whether a planned activity happened, using counts, milestones or the extent of implementation. An effectiveness measure describes the effect that the activity had on the organization's security objectives. Both are specific to the organization. Neither term is a synonym for the clause 9.1 duty to judge performance and effectiveness, and the register should keep the labels distinct so that a board report does not confuse activity with outcome.
What it means in practice
Performance measures tell you whether the planned activity happened. Effectiveness measures tell you whether it made a difference. Both are organisation-specific, and neither is the same thing as the clause 9.1 duty to evaluate performance and effectiveness. Keep the two labels visible in the register.
Status of this record. For 7.1, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Label every measure as performance or effectiveness in the register. Use performance measures to prove the activity happened, then effectiveness measures to show the result. Do not use one label for both in a board report.
Evidence an assessor asks for
- Performance evaluationEach measure classified as a performance or an effectiveness measure
- Performance evaluationThe organization's own objectives that effectiveness measures are tied to
The question an assessor will ask
An assessor will ask for each measure classified as a performance or an effectiveness measure. The test for 7.1 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- Every measure an implementation count, with nothing measuring effect on the objectives
- The two types conflated so that full implementation is reported as effectiveness
Before the next review
Before the next review, test this against one live record: every measure an implementation count, with nothing measuring effect on the objectives.
What to check when the revision publishes
When DIS 27004 is published, compare the 7.1 General: performance measures and effectiveness measures record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.