ISO/IEC DIS 27004   Stage 40.60, close of voting Planning date, an estimate 14 Sep 2027 The recordFree checkKit USD 799 and watch USD 49 a month
8.6Clause
Clause 8. The measurement processes

Analyse results

Guidance in the published 2016 editionRecord 25 of 67Updated 2026-10-21

Analysis compares the data with the target and explains the difference.

What the published 2016 guidance says

Analysis compares the data with the target and explains the difference. ISO/TR 10017 offers statistical guidance. The analyst may draw a first conclusion, but someone close to the technical or management process should review it, because the analyst may not know the context. Interpret every result in the setting in which it was produced. The output is a set of gaps between what was expected and what happened, and those gaps can point to changes in scope, policy, objectives, controls, processes or procedures.

What it means in practice

Analysis compares the result with the target and explains the gap. The analyst can draw a first conclusion, but someone close to the process should review it. Look for gaps in scope, policy, objectives, controls, processes and procedures. A gap with no owner is a finding waiting to happen.

Status of this record. For 8.6, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.

What good looks like

Compare each result with its target and write the explanation. Have someone close to the process review the conclusion. List the gaps by scope, policy, objective, control, process and procedure, with an owner for each.

Evidence an assessor asks for

  • Performance evaluationAnalysis records comparing each result to its target
  • AnalysisReview of the analyst's conclusions by process owners or other interested parties
  • Performance evaluationGaps between expected and actual results logged as improvement inputs

The question an assessor will ask

An assessor will ask for analysis records comparing each result to its target. The test for 8.6 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.

Common gaps

  • Results reported without comparison to a target
  • Conclusions published by the analyst with no review by anyone who runs the process
  • Identified gaps never entering the improvement process

Before the next review

Before the next review, test this against one live record: results reported without comparison to a target.

What to check when the revision publishes

When DIS 27004 is published, compare the 8.6 Analyse results record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.