Evaluate information security performance and ISMS effectiveness
Evaluation turns the analysis into an answer.
What the published 2016 guidance says
Evaluation turns the analysis into an answer. The organization should write its information needs as questions about performance and effectiveness, and write its measures so that they feed those questions. The analysis supplies the data; evaluation supplies the interpretation. This is the step where a number becomes a judgement about whether the objective is being met, whether the control is working and what should happen next. Without it, the programme reports activity and leaves the decision to someone who may never see the data.
What it means in practice
Evaluation answers the organisation's own questions about performance and effectiveness. Write the questions first, then check that each measure feeds one. The output is an interpretation, not a number: what the data means for the objective, the risk and the next decision.
Status of this record. For 8.7, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Write the evaluation questions with the information needs. Answer each with the analysed data. Record the interpretation, the confidence and the decision it supports. Keep the questions with the results for the next review.
Evidence an assessor asks for
- Performance evaluationInformation needs written as answerable questions
- GovernanceEvaluation records that answer each question from the analysed data
The question an assessor will ask
An assessor will ask for information needs written as answerable questions. The test for 8.7 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- Evaluation reported as a list of numbers rather than answers to the questions the numbers were collected for
- Questions about effectiveness answered with implementation counts
Before the next review
Before the next review, test this against one live record: evaluation reported as a list of numbers rather than answers to the questions the numbers were collected for.
What to check when the revision publishes
When DIS 27004 is published, compare the 8.7 Evaluate information security performance and ISMS effectiveness record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.