ISO/IEC DIS 27004   Stage 40.60, close of voting Planning date, an estimate 14 Sep 2027 The recordFree checkKit USD 799 and watch USD 49 a month
8.8Clause
Clause 8. The measurement processes

Review and improve the monitoring, measurement, analysis and evaluation processes

Guidance in the published 2016 editionRecord 27 of 67Updated 2026-10-21

The measurement process should improve with the management system.

What the published 2016 guidance says

The measurement process should improve with the management system. The guidance suggests asking interested parties for feedback, revising collection and analysis methods as lessons emerge, updating the procedures, and using benchmarking data with care. A programme that never changes its measures is either perfect or unexamined. Put a review date on the process itself, separate from the review dates of the individual measures, and record what changed and why.

What it means in practice

The measurement process is itself a process. Ask its users whether the reports helped, revise the collection and analysis methods, update the procedures, and use external benchmarking carefully. A programme that never changes its measures is either perfect or unexamined.

Status of this record. For 8.8, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.

What good looks like

Ask the users of the reports whether the reports helped. Review the collection and analysis methods on a set cycle. Update the procedure and record what changed and why.

Evidence an assessor asks for

  • Continual improvementFeedback from measurement clients recorded and acted on
  • Process managementChange history of collection and analysis techniques
  • Continual improvementBenchmarking data used to revise measures or targets

The question an assessor will ask

An assessor will ask for feedback from measurement clients recorded and acted on. The test for 8.8 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.

Common gaps

  • The measurement process never revised after its first design
  • Feedback from report recipients neither sought nor recorded

Before the next review

Before the next review, test this against one live record: the measurement process never revised after its first design.

What to check when the revision publishes

When DIS 27004 is published, compare the 8.8 Review and improve the monitoring, measurement, analysis and evaluation processes record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.