Keep management informed and engaged
Management at each level should help shape the measures, because the measures have to answer the questions that level actually asks.
What the published 2016 guidance says
Management at each level should help shape the measures, because the measures have to answer the questions that level actually asks. Keep those managers informed while the programme is being built, not only after it reports. Use the format and style each audience reads. A measure that management has never seen is unlikely to survive its first poor result, and a programme that reports only when something goes wrong teaches managers to associate measurement with bad news.
What it means in practice
Management has to see the measures while they are being built, not only when they fail. Ask each level what it needs to decide, show the draft construct, and report in the format that level reads. A measure that management has never seen is unlikely to survive its first poor result.
Status of this record. For 8.3.5, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Show each management level the draft measures and ask what decision they support. Report in the format that level uses. Keep a short log of the feedback and the changes it produced.
Evidence an assessor asks for
- GovernanceRecords of management input to measure design
- CommunicationRegular measurement updates to management in a format fit for the audience
The question an assessor will ask
An assessor will ask for records of management input to measure design. The test for 8.3.5 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- Measures designed by the security function alone and presented to management only at review time
- Technical dashboards sent unchanged to executives
Before the next review
Before the next review, test this against one live record: measures designed by the security function alone and presented to management only at review time.
What to check when the revision publishes
When DIS 27004 is published, compare the 8.3.5 Keep management informed and engaged record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.