Create measures once, then review and update them at planned intervals and on substantial change
Treat the measure set as a controlled asset.
What the published 2016 guidance says
Treat the measure set as a controlled asset. Give it a review date and a list of triggers. The guidance names several: a change of scope; a change in organization or in the roles and authority of interested parties; new business objectives or requirements; new law; a result that has been stable for several cycles; and the arrival or removal of technology. Creating or updating a measure means finding the existing practices that can serve the need, developing the measure, documenting it, setting its priority and keeping management involved.
What it means in practice
Treat the measure set as a controlled asset. Give it a review date and a trigger list. A change of scope, a reorganisation, a new regulator, a stable result for several cycles or a new system is a reason to revisit the measure, not a reason to keep reporting it unchanged.
Status of this record. For 8.3.1, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Put the review date and the trigger list in the register. On each review, ask whether the information need, the formula, the source or the target has changed. Record the decision even when it is "no change".
Evidence an assessor asks for
- Performance evaluationA review schedule for the measure set and records of reviews
- Change managementMeasures retired or replaced after a scope, structure, legal or technology change
- Performance evaluationRecords of measures reviewed after several stable cycles at target
The question an assessor will ask
An assessor will ask for A review schedule for the measure set and records of reviews. The test for 8.3.1 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- Measures unchanged since the ISMS was first certified
- Measures still counting a system that was decommissioned
- A stable 100 percent reported every period with no decision to move on
Before the next review
Before the next review, test this against one live record: measures unchanged since the ISMS was first certified.
What to check when the revision publishes
When DIS 27004 is published, compare the 8.3.1 Create measures once, then review and update them at planned intervals and on substantial change record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.