Improvement actions
Improvement actions need a measure that does not average away the critical few.
What the published 2016 guidance says
Improvement actions need a measure that does not average away the critical few. The construct counts the actions delivered within time, cost and quality against all actions open at the start of the period, as a percentage, with an illustrative target of 90. The evidence is the status of each action. The project management office owns and collects it, and the security manager is the client. The report lists every action with its forecast against plan, and the example notes that actions addressing high risks should be weighted so that a crowd of minor actions cannot hide a serious one.
What it means in practice
Improvement actions are often measured by count, which hides the critical few. This construct weights time, cost and quality and keeps the full list beside the percentage. The note in the example is the useful part: a critical action outside its bounds should not be averaged away.
Status of this record. For B.7, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Keep the action list with time, cost, quality and criticality. Report the percentage on track and attach the full list. Flag any critical action outside its bounds separately from the average.
Evidence an assessor asks for
- ImprovementImprovement action register with planned time, cost and quality
- Project managementQuarterly status list with the on-track percentage
- ImprovementCriticality weighting where used
The question an assessor will ask
An assessor will ask for improvement action register with planned time, cost and quality. The test for B.7 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- A single percentage hiding overdue critical actions
- Actions with no planned cost or quality criteria, so only time is measured
Before the next review
Before the next review, test this against one live record: A single percentage hiding overdue critical actions.
What to check when the revision publishes
When DIS 27004 is published, compare the B.7 Improvement actions record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.