Annex B: measurement construct examples
Annex B contains 36 worked constructs on the common template, each tied to a clause or control of the 2013 requirement standard.
What the published 2016 guidance says
Annex B contains 36 worked constructs on the common template, each tied to a clause or control of the 2013 requirement standard. The table at B.1 maps them: resource allocation; policy review; management commitment; risk exposure; the audit programme; improvement actions; incident cost, learning and corrective action; training, awareness and campaign measures; social engineering; password quality; access review; physical entry; maintenance; change; malware; availability; firewall rules; log review; device configuration; testing and vulnerability measures; third-party agreements; incident management and trend; event reporting; the management system review; and vulnerability coverage. Two examples add an action field.
What it means in practice
These are examples, not a mandatory catalogue. Each follows the template and names the control it serves. Take the one closest to your control, change the formula, target and data source to your organisation, and keep the information need and the reporting format. Do not copy the target.
Status of this record. For B, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Choose the example closest to the control. Rewrite the information need, formula, target, frequency and owner for the organisation. Keep the reporting format and the action descriptor. Record the source of the target.
Evidence an assessor asks for
- Performance evaluationThe link from each example to the clause or control it serves
- Performance evaluationThe adapted construct, with the local target and data source
The question an assessor will ask
An assessor will ask for the link from each example to the clause or control it serves. The test for B is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- An example is copied with its target and data source unchanged
- The information need is dropped and only the formula is kept
- The reporting format is ignored, so the result cannot be read by the client
Before the next review
Before the next review, test this against one live record: an example is copied with its target and data source unchanged.
What to check when the revision publishes
When DIS 27004 is published, compare the B Annex B: measurement construct examples record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.