Monitor and measure
Collect, verify and store before analysing.
What the published 2016 guidance says
Collect, verify and store before analysing. The guidance allows manual or automated collection, and asks for a verification step so that missing data has a minimal effect and the values are right or within known bounds. Collect enough to make the analysis reliable. Report at the established interval. Revisit the process when a trigger in 8.3.1 occurs. Before publishing a report or dashboard, decide who may see the data and at what level of detail, because incident and vulnerability information is sensitive. Check that the collection itself is repeatable, precise and consistent.
What it means in practice
Collect and verify before you analyse. Missing data changes the analysis, so record it. Before a dashboard is published, decide who may see the data and at what granularity, because incident and vulnerability data are sensitive. Check the collection process itself: repeatable, precise and consistent.
Status of this record. For 8.5, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Collect, verify and store before analysis. Record missing data and its likely effect. Decide who may see the result before the dashboard is published. Run a periodic check that the collection is repeatable, precise and consistent.
Evidence an assessor asks for
- MonitoringCollection records at the defined periodicity with verification checklists
- Data qualityA sharing or classification decision recorded for measurement reports
- ConfidentialityReviews of the collection process for repeatability and precision
The question an assessor will ask
An assessor will ask for collection records at the defined periodicity with verification checklists. The test for 8.5 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- Vulnerability and incident dashboards shared without a confidentiality decision
- Gaps in the series with no record of why data were missing
- Nobody checking that the collection itself is still measuring what it was designed to
Before the next review
Before the next review, test this against one live record: vulnerability and incident dashboards shared without a confidentiality decision.
What to check when the revision publishes
When DIS 27004 is published, compare the 8.5 Monitor and measure record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.