Performance measures
Performance measures show progress in putting processes, procedures and controls in place.
What the published 2016 guidance says
Performance measures show progress in putting processes, procedures and controls in place. The data are ordinary records: minutes, attendance lists, project plans, scan output. Collection, analysis and reporting should be automated where possible to cut cost and error. A laptop encryption measure starts below full coverage and can be retired from close attention once it holds at the top. A new management system may begin with attendance at review meetings against the planned attendance. When a performance measure sits at its ceiling, shift effort to effectiveness, but keep a light check because controls can slip.
What it means in practice
Performance measures are a completion check: encryption rolled out, reviews held, patches applied. Automate the collection where you can. When a measure sits at 100 percent for several cycles, move effort to effectiveness, but keep a light check because a control can slip back.
Status of this record. For 7.2, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Automate the collection where the source allows it. Set a review trigger for any measure that has been at 100 percent for several cycles. Retire the measure only when the control is stable and another measure covers the risk.
Evidence an assessor asks for
- Performance evaluationImplementation-degree measures for the necessary controls with their 100 percent milestones
- AutomationAutomated collection where the data source allows it
- Performance evaluationA record of measures whose emphasis was reduced once they stabilised
The question an assessor will ask
An assessor will ask for implementation-degree measures for the necessary controls with their 100 percent milestones. The test for 7.2 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- Performance measures retired entirely once they hit target
- Manual collection of data that a scanning tool already produces
- A programme that never moves beyond implementation counts
Before the next review
Before the next review, test this against one live record: performance measures retired entirely once they hit target.
What to check when the revision publishes
When DIS 27004 is published, compare the 7.2 Performance measures record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.