Effectiveness measures
Effectiveness measures describe the difference that the treatment plan, the processes and the controls make to the objectives.
What the published 2016 guidance says
Effectiveness measures describe the difference that the treatment plan, the processes and the controls make to the objectives. They can put a figure on avoided cost, incident cost, customer trust or another objective. Building them takes more than one source: automated monitoring, manual records and the organization's own interpretation. That requires a working capability to evaluate implementation, collect from tools and people, normalise the data and report to decision makers. These measures also feed the risk process, and they give top management the clearest view of the value of security work.
What it means in practice
Effectiveness measures combine the treatment plan with what actually changed: incident cost, trust retained, objectives met. They need clean performance data, data from more than one source, and a person who can interpret the result. This is the layer top management reads, so the reporting format matters as much as the formula.
Status of this record. For 7.3, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Build effectiveness measures from at least two data sources. Record the interpretation and the decision, not only the number. Present them to top management in the language of objectives and risk, with the performance data as an appendix.
Evidence an assessor asks for
- Performance evaluationEffectiveness measures tied to stated objectives, with the multiple data points each combines
- Control effectivenessThe normalisation method used across automated and manual sources
- Performance evaluationEffectiveness results presented to top management and used in risk management
The question an assessor will ask
An assessor will ask for effectiveness measures tied to stated objectives, with the multiple data points each combines. The test for 7.3 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- Effectiveness claimed from a single automated count
- Data from different sources combined with no normalisation
- Effectiveness results never reaching the risk process or top management
Before the next review
Before the next review, test this against one live record: effectiveness claimed from a single automated count.
What to check when the revision publishes
When DIS 27004 is published, compare the 7.3 Effectiveness measures record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.