Document measures and prioritise for implementation
Once the measures are written down, put them in order.
What the published 2016 guidance says
Once the measures are written down, put them in order. Priority follows the importance of the information need and the practicality of getting the data. Performance measures come first, because they show whether the process or control is actually in place. Effectiveness measures follow once those performance figures are reaching their targets. The timing rules in 6.4 govern how long each stage runs. A long list of measures with no sequence is a wish list, not a programme.
What it means in practice
Document the set, then sequence it. Performance measures come first because they show whether the process or control exists. Effectiveness measures follow once the performance data is stable. The priority of the information need decides the order, and the feasibility of getting the data decides the pace.
Status of this record. For 8.3.4, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Sequence the measures by information-need priority and data feasibility. Start with the performance measures that prove the process exists. Add effectiveness measures when the performance series is stable, and record the decision to wait.
Evidence an assessor asks for
- Performance evaluationA documented, prioritised implementation list of measures
- PlanningEvidence that performance measures preceded effectiveness measures
The question an assessor will ask
An assessor will ask for A documented, prioritised implementation list of measures. The test for 8.3.4 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- Effectiveness measured for controls whose implementation was never confirmed
- Measures implemented in the order the tool offered them
Before the next review
Before the next review, test this against one live record: effectiveness measured for controls whose implementation was never confirmed.
What to check when the revision publishes
When DIS 27004 is published, compare the 8.3.4 Document measures and prioritise for implementation record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.