Annex A gives the measurement information model. Annex B gives 36 worked constructs, each tied to a control or process and each on the same template. Annex C shows a free-form construct. Every page names the information need, the formula, the target, the data source, the frequency and the owner.
Annex A. The measurement information model
Annex B. Measurement construct examples
- BAnnex B: measurement construct examples
- B.2Resource allocation
- B.3Policy review
- B.4Management commitment
- B.5Risk exposure
- B.6Audit programme
- B.7Improvement actions
- B.8Security incident cost
- B.9Learning from information security incidents
- B.10Corrective action implementation
- B.11ISMS training or ISMS awareness
- B.12Information security training
- B.13Information security awareness compliance
- B.14ISMS awareness campaigns effectiveness
- B.15Social engineering preparedness
- B.16Password quality, manual
- B.17Password quality, automated
- B.18Review of user access rights
- B.19Physical entry controls system evaluation
- B.20Physical entry controls effectiveness
- B.21Management of periodic maintenance
- B.22Change management
- B.23Protection against malicious code
- B.24Anti-malware
- B.25Total availability
- B.26Firewall rules
- B.27Log files review
- B.28Device configuration
- B.29Pentest and vulnerability assessment
- B.30Vulnerability landscape
- B.31Security in third party agreements, A
- B.32Security in third party agreements, B
- B.33Information security incident management effectiveness
- B.34Security incidents trend
- B.35Security event reporting
- B.36ISMS review process
- B.37Vulnerability coverage
Annex C. A free-form construct
The examples are from the published 2016 edition. They are examples, not a mandatory catalogue. The target and the data source always need the organization's own values.