Annex A: the information security measurement model
Annex A applies the measurement information model of ISO/IEC 15939 to a management system.
What the published 2016 guidance says
Annex A applies the measurement information model of ISO/IEC 15939 to a management system. The chain runs from an information need to the entities of interest (a process, control, document, system, device, person or resource) and their attributes. Attributes are quantified as base measures. Two or more base measures are combined by a measurement function into a derived measure. Derived measures become indicators that support a decision, and the most significant indicators can be treated as key indicators. The model tells the planner what to specify; it is one sound approach, not the only one.
What it means in practice
The model is a chain from information need to entity and attribute, base measure, derived measure, indicator, and key indicator. Use it to test whether a measure has a traceable construction. It is one way to satisfy the requirement, not the only one, and a simple construct that people use beats a perfect model that they do not.
Status of this record. For A, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Use the model to trace one measure from need to indicator. Name the entity, the attribute, the base measure, the function and the indicator. If a link is missing, the measure is not yet constructed; it is only a data field.
Evidence an assessor asks for
- Performance evaluationMeasurement constructs that show the entity, attribute, base measures, function, derived measure and indicator
- MethodologyThe key performance indicators selected from the indicators and the reason for their selection
The question an assessor will ask
An assessor will ask for measurement constructs that show the entity, attribute, base measures, function, derived measure and indicator. The test for A is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- Indicators presented with no traceable base measures
- Every indicator called a KPI, so nothing is key
Before the next review
Before the next review, test this against one live record: indicators presented with no traceable base measures.
What to check when the revision publishes
When DIS 27004 is published, compare the A Annex A: the information security measurement model record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.