ISO/IEC DIS 27004   Stage 40.60, close of voting Planning date, an estimate 14 Sep 2027 The recordFree checkKit USD 799 and watch USD 49 a month
B.4Annex
Annex B. Measurement construct examples

Management commitment

Worked example in the published 2016 guidanceRecord 34 of 67Updated 2026-10-21

Management commitment can be counted rather than asserted.

What the published 2016 guidance says

Management commitment can be counted rather than asserted. Two measures are proposed: the number of review meetings held against those scheduled, and the average participation rate with its spread. A ratio between 0.7 and 1.1 is treated as achieved, and at least 0.5 as the minimum. A wide spread in attendance suggests an unstable process and a need for contingency planning. The evidence is the schedule and the minutes, with counts of planned, held, unplanned and rescheduled meetings and of the managers who attended. It is collected monthly, analysed quarterly and reviewed every two years.

What it means in practice

Management commitment is measurable without asking people how committed they feel. Count the reviews held against those scheduled and the participation rate. A wide spread in attendance is itself a finding, because it points to an unstable review process.

Status of this record. For B.4, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.

What good looks like

Keep the review schedule, the attendance list and the minutes. Count scheduled and held meetings, and record attendance. Review the measure when the review cycle changes.

Evidence an assessor asks for

  • LeadershipManagement review schedule and minutes with attendance
  • Management reviewThe line chart with criteria over several periods

The question an assessor will ask

An assessor will ask for management review schedule and minutes with attendance. The test for B.4 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.

Common gaps

  • Reviews held but attendance not recorded
  • Unplanned reviews uncounted, understating commitment

Before the next review

Before the next review, test this against one live record: reviews held but attendance not recorded.

What to check when the revision publishes

When DIS 27004 is published, compare the B.4 Management commitment record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.