Identify current security practices that can support information needs
Before designing a new collection, inventory what the organization already measures.
What the published 2016 guidance says
Before designing a new collection, inventory what the organization already measures. Risk management, project management, compliance reporting and security policy often produce data that can be reused. An existing source is usually cheaper and has a longer history, which makes the first trend more honest. The inventory should record the source, its owner, its history and the information need it could serve. Build new only where the existing practice is not fit for the purpose, and say why.
What it means in practice
Inventory what already exists before buying anything. Risk management, project management, compliance reporting and security policy often produce usable data. Reusing a practice is cheaper than a new collection, and it usually has a longer history, which makes the first trend more honest.
Status of this record. For 8.3.2, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Inventory the existing sources before designing a new collection. Map each source to a candidate measure and note its history and owner. Reuse the source if it is fit for purpose; record why if it is not.
Evidence an assessor asks for
- Performance evaluationAn inventory of existing measurement in risk, project, compliance and policy processes
- Performance evaluationMeasures that reuse an existing data feed rather than a new collection
The question an assessor will ask
An assessor will ask for an inventory of existing measurement in risk, project, compliance and policy processes. The test for 8.3.2 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- New collection built where compliance reporting already produced the number
- Risk and project metrics ignored by the security measurement programme
Before the next review
Before the next review, test this against one live record: new collection built where compliance reporting already produced the number.
What to check when the revision publishes
When DIS 27004 is published, compare the 8.3.2 Identify current security practices that can support information needs record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.