SIST ISO/IEC 27004:2018

SLOVENSKI STANDARD
01-november-2018
Nadomešča:
SIST ISO/IEC 27004:2011
Informacijska tehnologija - Varnostne tehnike - Vodenje informacijske varnosti -
Spremljanje, merjenje, analiza in evalvacija
Information technology -- Security techniques -- Information security management --
Monitoring, measurement, analysis and evaluation
Technologies de l'information -- Techniques de sécurité -- Management de la sécurité de
l'information -- Surveillance, mesurage, analyse et évaluation
Ta slovenski standard je istoveten z: ISO/IEC 27004:2016
ICS:
03.100.70 Sistemi vodenja Management systems
35.030 Informacijska varnost IT Security
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

INTERNATIONAL ISO/IEC
STANDARD 27004
Second edition
2016-12-15
Information technology — Security
techniques — Information security
management — Monitoring,
measurement, analysis and evaluation
Technologies de l’information — Techniques de sécurité —
Management de la sécurité de l’information —
Surveillance, mesurage, analyse et évaluation
Reference number
©
ISO/IEC 2016
© ISO/IEC 2016, Published in Switzerland
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form
or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior
written permission. Permission can be requested from either ISO at the address below or ISO’s member body in the country of
the requester.
ISO copyright office
Ch. de Blandonnet 8 • CP 401
CH-1214 Vernier, Geneva, Switzerland
Tel. +41 22 749 01 11
Fax +41 22 749 09 47
copyright@iso.org
www.iso.org
ii © ISO/IEC 2016 – All rights reserved

Contents Page
Foreword .iv
Introduction .v
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Structure and overview . 1
5 Rationale . 2
5.1 The need for measurement . 2
5.2 Fulfilling the ISO/IEC 27001 requirements . 3
5.3 Validity of results . 3
5.4 Benefits . 3
6 Characteristics . 4
6.1 General . 4
6.2 What to monitor. 4
6.3 What to measure . 5
6.4 When to monitor, measure, analyse and evaluate . 6
6.5 Who will monitor, measure, analyse and evaluate . 6
7 Types of measures . 7
7.1 General . 7
7.2 Performance measures . 7
7.3 Effectiveness measures . 8
8 Processes . 9
8.1 General . 9
8.2 Identify information needs .10
8.3 Create and maintain measures .11
8.3.1 General.11
8.3.2 Identify current security practices that can support information needs .11
8.3.3 Develop or update measures .12
8.3.4 Document measures and prioritize for implementation .13
8.3.5 Keep management informed and engaged .13
8.4 Establish procedures .14
8.5 Monitor and measure .14
8.6 Analyse results .15
8.7 Evaluate information security performance and ISMS effectiveness .15
8.8 Review and improve monitoring, measurement, analysis and evaluation processes .15
8.9 Retain and communicate documented information .15
Annex A (informative) An information security measurement model .17
Annex B (informative) Measurement construct examples .19
Annex C (informative) An example of free-text form measurement construction .57
Bibliography .58
© ISO/IEC 2016 – All rights reserved iii

Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are
members of ISO or IEC participate in the development of International Standards through technical
committees established by the respective organization to deal with particular fields of technical
activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international
organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the
work. In the field of information technology, ISO and IEC have established a joint technical committee,
ISO/IEC JTC 1.
The procedures used to develop this document and those intended for its further maintenance are
described in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for
the different types of document should be noted. This document was drafted in accordance with the
editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).
Attention is drawn to the possibility that some of the elements of this document may be the subject
of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent
rights. Details of any patent rights identified during the development of the document will be in the
Introduction and/or on the ISO list of patent declarations received (see www.iso.org/patents).
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation on the meaning of ISO specific terms and expressions related to conformity assessment,
as well as information about ISO’s adherence to the World Trade Organization (WTO) principles in the
Technical Barriers to Trade (TBT) see the following URL: www.iso.org/iso/foreword.html.
The committee responsible for this document is ISO/IEC JTC 1, Information technology, Subcommittee
SC 27, IT Security techniques.
This second edition of ISO/IEC 27004 cancels and replaces the first edition (ISO/IEC 27004:2009),
which has been technically revised.
This edition includes the following significant changes with respect to the previous edition:
A total restructuring of the document because it has a new purpose – to provide guidance on
ISO/IEC 27001:2013, 9.1 – which, at the time of the previous edition, did not exist.
The concepts and processes have been modified and expanded. However, the theoretical foundation
(ISO/IEC 15939) remains the same and several of the examples given in the previous edition are
preserved, albeit updated.
iv © ISO/IEC 2016 – All rights reserved

Introduction
This document is intended to assist organizations to evaluate the information security performance
and the effectiveness of an information security management system in order to fulfil the requirements
of ISO/IEC 27001:2013, 9.1: monitoring, measurement, analysis and evaluation.
The results of monitoring and measurement of an information security management system (ISMS)
can be supportive of decisions relating to ISMS governance, management, operational effectiveness and
continual improvement.
As with other ISO/IEC 27000 documents, this document should be considered, interpreted and adapted
to suit each organization’s specific situation. The concepts and approaches are intended to be broadly
applicable but the particular measures that any particular organization requires depend on contextual
factors (such as its size, sector, maturity, information security risks, compliance obligations and
management style) that vary widely in practice.
This document is recommended for organizations implementing an ISMS that meets the requirements
of ISO/IEC 27001. However, it does not establish any new requirements for ISMS which conform to
ISO/IEC 27001 or impose any obligations upon organizations to observe the guidelines presented.
© ISO/IEC 2016 – All rights reserved v

INTERNATIONAL STANDARD ISO/IEC 27004:2016(E)
Information technology — Security techniques —
Information security management — Monitoring,
measurement, analysis and evaluation
1 Scope
This document provides guidelines intended to assist organizations in evaluating the information
security performance and the effectiveness of an information security management system in order to
fulfil the requirements of ISO/IEC 27001:2013, 9.1. It establishes:
a) the monitoring and measurement of information security performance;
b) the monitoring and measurement of the effectiveness of an information security management
system (ISMS) including its processes and controls;
c) the analysis and evaluation of the results of monitoring and measurement.
This document is applicable to all types and sizes of organizations.
2 Normative references
The following documents are referred to in the text in such a way that some or all of their content
constitutes requirements of this document. For dated references, only the edition cited applies. For
undated references, the latest edition of the referenced document (including any amendments) applies.
There are no normative references in this document.
3 Terms and definitions
For the purposes of this document, the terms and definitions given in ISO/IEC 27000 apply.
ISO and IEC maintain terminological databases for use in standardization at the following addresses:
— IEC Electropedia: available at http://www.electropedia.org/
— ISO Online browsing platform: available at http://www.iso.org/obp
4 Structure and overview
This document is structured as follows:
a) Rationale (Clause 5);
b) Characteristics (Clause 6);
c) Types of measures (Clause 7);
d) Processes (Clause 8).
The ordering of these clauses is intended to aid understanding and map to ISO/IEC 27001:2013, 9.1
requirements, as is illustrated in Figure 1.
Starting with the information needed to fulfil that requirement, referred to as information needs, the
organization determines the measures that it will use to fulfil those information needs. The process
© ISO/IEC 2016 – All rights reserved 1

of monitoring and measurement produces data which is then analysed. The results of analysis are
evaluated in fulfilment of the organization’s information needs.
In addition, Annex A describes a measurement model for information security, including the relationship
between the components of the measurement model and the requirements of ISO/IEC 27001:2013, 9.1.
Annex B provides a wide range of examples. These examples are intended to provide practical guidance
on how organizations can monitor, measure, analyse and evaluate their chosen ISMS processes and
areas of information security performance. These examples use the suggested template given in Table 1.
Annex C provides a further example using an alternative free-form text-based format.
Figure 1 — Mapping to ISO/IEC 27001:2013, 9.1 requirements
5 Rationale
5.1 The need for measurement
The overall objective of an ISMS is the preservation of confidentiality, integrity and availability of
information within its scope. There are ISMS activities that concern the planning of how to do this, and
the implementation of those plans. However, by themselves, these activities cannot guarantee that the
realisation of those plans fulfil the information security objectives. Therefore, in the ISMS as defined
by ISO/IEC 27001, there are several requirements to evaluate if the plans and activities ensure the
fulfilment of the information security objectives.
2 © ISO/IEC 2016 – All rights reserved

5.2 Fulfilling the ISO/IEC 27001 requirements
ISO/IEC 27001:2013, 9.1 requires the organization to evaluate the information security performance
and the effectiveness of the ISMS. Measure types able to fulfil these requirements can be found in
Clause 7.
ISO/IEC 27001:2013, 9.1 further requires the organization to determine:
a) what needs to be monitored and measured, including information security processes and controls;
b) the methods for monitoring, measurement, analysis and evaluation, as applicable, to ensure valid
results;
c) when the monitoring and measuring shall be performed;
d) who shall monitor and measure;
e) when the results from monitoring and measurement shall be analysed and evaluated; and
f) who shall analyse and evaluate these results.
The mapping of these requirements is provided in Figure 1.
Finally, ISO/IEC 27001:2013, 9.1 requires the organization to retain appropriate documented
information as evidence of the monitoring and measurement results (See 8.9).
ISO/IEC 27001:2013, 9.1 also notes that methods selected should produce comparable and reproducible
results in order for them to be considered valid (See 6.4).
5.3 Validity of results
ISO/IEC 27001:2013, 9.1 b) requires that organizations choose methods for measurement, monitoring,
analysis and evaluation to ensure valid results. The clause notes that to be valid, results should
be comparable and reproducible. To achieve this, organizations should collect, analyse, and report
measures, taking the following points into consideration:
a) in order to get comparable results on measures that are based on monitoring at different points in
times, it is important to ensure that scope and context of the ISMS are not changed;
b) changes in the methods or techniques used for measuring and monitoring do not generally lead to
comparable results. In order to retain comparability, specific tests such as parallel application of
the original as well as the changed methods can be required;
c) if subjective elements are part of the methods or techniques used for measuring and monitoring,
specific steps can be needed to obtain reproducible results. As an example, questionnaire results
should be evaluated against defined criteria; and
d) in some situations, reproducibility can only be given in specific circumstances. For example, there
are situations where results are non-reproducible, but are valid when aggregated.
5.4 Benefits
Fulfilling ISMS processes and controls and ensuring information security performance can provide a
number of organizational and financial benefits. Major benefits can include:
a) Increased accountability: Monitoring, measurement, analysis and evaluation can increase
accountability for information security by helping to identify specific information security
processes or controls that are implemented incorrectly, are not implemented, or are ineffective.
b) Improved information security performance and ISMS processes: Monitoring, measurement,
analysis and evaluation can enable organizations to quantify improvements in securing information
© ISO/IEC 2016 – All rights reserved 3

within the scope of their ISMS and demonstrate quantifiable progress in accomplishing the
organization’s information security objectives.
c) Evidence of meeting requirements: Monitoring, measurement, analysis and evaluation can
provide documented evidence that helps demonstrate fulfilling of ISO/IEC 27001 (and other
standards) requirements, as well as applicable laws, rules, and regulations.
d) Support decision-making: Monitoring, measurement, analysis and evaluation can support risk-
informed decision-making by contributing quantifiable information to the risk management
process. It can allow organizations to measure successes and failures of past and current
information security investments, and should provide quantifiable data that can support resource
allocation for future investments.
6 Characteristics
6.1 General
Monitoring and measurement is the first step in a process to evaluate information security performance
and ISMS effectiveness.
Faced with a potentially overwhelming variety of attributes of information security-related entities
that can be measured, it is not entirely obvious which ones should be measured. This is an important
issue because it is impracticable, costly and counterproductive to measure too many or the wrong
attributes. Aside from the obvious costs of measuring, analysing and reporting numerous attributes,
there is a distinct possibility that key issues can be obscured within a large volume of information or
missed altogether if suitable measures are not in place.
In order to determine what to monitor and measure, the organization should first consider what it
wishes to achieve in evaluating information security performance and ISMS effectiveness. This can
allow it to determine its information needs.
Organizations should next decide what measures are needed to support each discrete information
need and what data are required to derive the requisite measures. Hence, measurement should always
correspond to the information needs of the organization.
6.2 What to monitor
Monitoring determines the status of a system, a process or an activity in order to meet a specified
information need.
Systems, processes and activities which can be monitored include, but are not limited to:
a) implementation of ISMS processes;
b) incident management;
c) vulnerability management;
d) configuration management;
e) security awareness and training;
f) access control, firewall and other event logging;
g) audit;
h) risk assessment process;
i) risk treatment process;
j) third party risk management;
4 © ISO/IEC 2016 – All rights reserved

k) business continuity management;
l) physical and environmental security management; and
m) system monitoring.
These monitoring activities produce data (event logs, user interviews, training statistics, incident
information, etc.) that can be used to support other measures. In the process of defining attributes to be
measured, additional monitoring can be required to provide supporting information.
Note that monitoring can allow an organization to determine whether a risk has materialized, and
thereby indicate what action it can take to treat such a risk itself. Note also that there can be certain
types of information security controls that have the explicit purpose of monitoring. When using outputs
of such controls to support measurement, organizations should ensure that the measurement process
takes into account whether the data used was obtained before or after any treatment action was taken.
6.3 What to measure
Measurement is an activity undertaken to determine a value, status or trend in performance or
effectiveness to help identify potential improvement needs. Measurement can be applied to any ISMS
processes, activities, controls and groups of controls.
As an example, consider ISO/IEC 27001:2013, 7.2 c), which requires an organization to take action, where
applicable, to acquire necessary competence. An organization can determine whether all individuals
who require training have received it and whether the training was delivered as planned. This can be
measured by the number or percentage of people trained. An organization can also determine whether
the individuals who have been trained actually acquired and retained the necessary competence (which
can be measured with a post-training questionnaire).
With regards to ISMS processes, organizations should note that there are a number of clauses in
ISO/IEC 27001 that explicitly require the effectiveness of some activity to be determined. For example,
ISO/IEC 27001:2013, 10.1 d) requires organizations to “review the effectiveness of any corrective
action taken”. In order to perform such a review, the effectiveness of corrective actions should first be
determined in terms of some defined form of measure. In order to do this the organization should first
define an appropriate information need and a measure, or measures, to satisfy it. The process for doing
this is explained in Clause 8.
ISMS processes and activities that are candidates for measurement include:
a) planning;
b) leadership;
c) risk management;
d) policy management;
e) resource management;
f) communicating;
g) management review;
h) documenting; and
i) auditing.
With regards to information security performance, the most obvious candidates are the organization’s
information security controls or groups of such controls (or even the entire risk treatment plan). These
controls are determined through the process of risk treatment and are referred to in ISO/IEC 27001 as
necessary controls. They can be ISO/IEC 27001:2013, Annex A controls, sector-specific controls (e.g. as
defined in standards such as ISO/IEC 27010), controls specified by other standards and controls that
© ISO/IEC 2016 – All rights reserved 5

have been designed by the organization. As the purpose of a control is to modify risk, there are a variety
of attributes that can be measured, such as:
j) the degree to which a control reduces the likelihood of the occurrence of an event;
k) the degree to which a control reduces the consequence of an event;
l) the frequency of events that a control can cope with before failure; and
m) how long after the occurrence of an event does it take for the control to detect that the event has
occurred.
6.4 When to monitor, measure, analyse and evaluate
Organizations should define specific timeframes in which to monitor, measure, analyse, and evaluate,
based on individual information needs, required measures, and the lifecycle of data supporting
individual measures. The data supporting measures can be collected more frequently than the analysis
and reporting of such measures to individual interested parties. For example, while data on security
incidents can be collected continually, reporting of such data to external interested parties should be
based on specific requirements, such as severity (possibly requiring immediate notification as in the
case of a reportable breach) or aggregated values (as might be the case for attempted intrusions which
were detected and blocked).
Organizations should note that in order to satisfy certain information needs, before analysis and
evaluation can proceed, an appropriate volume of data needs to be collected in order to provide
a meaningful basis for assessment and comparison (e.g. when conducting statistical analysis). In
addition, the processes of monitoring, measurement, analysis, and evaluation can need testing and
fine-tuning before the resulting measures can be useful to the organization. Organizations should
therefore determine a limit to the duration of any fine-tuning (so as to proceed with the real objective,
measurement of the ISMS) and for how long monitoring and collection should continue before analysis
and evaluation can commence.
Organizations can adjust their measurement timeframes, as they update their measurement activities,
to address specific environmental changes listed in 8.2. For example, if an organization is transitioning
from a manual data source to an automated source, a change in frequency of collection can be required.
Furthermore, a baseline is needed to compare two sets of measures taken at different points in time
and potentially by different methods but aiming to fulfil the same information need.
An organization can choose to structure their monitoring, measurement, analysis, and evaluation
activities into a measurement programme. It is important to note, however, that ISO/IEC 27001 has no
requirement for organizations to have such a programme.
6.5 Who will monitor, measure, analyse and evaluate
Organizations (considering requirements of ISO/IEC 27001:2013, 9.1 and 5.3) should specify who
monitors, measures, analyses and evaluates in terms of individuals or roles. Monitoring, measurement,
analysis, and evaluation can be performed using either manual or automated means. Whether
the measurement is performed manually or automatically, organizations can define the following
measurement-related roles and responsibilities:
a) measurement client: the management or other interested parties requesting or requiring
information about the effectiveness of an ISMS, controls or group of controls;
b) measurement planner: the person or organizational unit that defines the measurement constructs
that links measurable attributes to a specified information need;
c) measurement reviewer: the person or organizational unit that validates that the developed
measurement constructs are appropriate for evaluating information security performance and the
effectiveness of an ISMS, controls or group of controls;
6 © ISO/IEC 2016 – All rights reserved

d) information owner: the person or organizational unit that owns the information that provides
input into measures. This person is responsible for providing the data and is also frequently (but
not always) responsible for conducting measurement activities;
e) information collector: the person or organizational unit responsible for collecting, recording and
storing the data;
f) information analyst: the person or organizational unit responsible for analysing data; and
g) information communicator: the person or organizational unit responsible for communicating the
results of analysis.
Organizations can combine some, or possibly all, of these roles.
Individuals performing different roles and responsibilities throughout the processes can require
diverse skill sets and associated awareness and training.
7 Types of measures
7.1 General
For the purposes of this guidance, the performance of planned activities and the effectiveness of the
results can be measured by applying the two following types of measures:
a) performance measures: measures that express the planned results in terms of the characteristics
of the planned activity, such as head counts, milestone accomplishment, or the degree to which
information security controls have been implemented;
b) effectiveness measures: measures that express the effect that realization of the planned activities
has on the organization’s information security objectives.
These measures can be inherently organization-specific since each organization has its own particular
information security objectives, policies and requirements.
Note that the terms “performance measures” and “effectiveness measures” should not be confused
with the ISO/IEC 27001:2013, 9.1 requirement to evaluate information security performance and ISMS
effectiveness.
7.2 Performance measures
Performance measures can be used to demonstrate progress in implementing ISMS processes, associated
procedures and specific security controls. Whereas effectiveness concerns the extent to which planned
activities have been realised and intended results achieved, performance measures should concern the
extent to which information security processes and controls have been implemented. These measures
help determine whether the ISMS processes and information security controls have been implemented
as specified.
Performance measures use data that can be obtained from minutes, attendance records, project plans,
automated scanning tools and other commonly-used means of documenting, recording, and monitoring
ISMS activities.
The collection, analysis, and reporting of measures should be automated wherever possible, in order to
reduce the cost and effort required and the potential for human error.
© ISO/IEC 2016 – All rights reserved 7

Example 1
When measuring the degree of implementation of specific information security controls, such as
the percentage of laptops with hard disk encryption, the results of this measure will likely be, at
first, less than 100%. When the result reaches and remains at 100%, it can be concluded that the
information systems have fully implemented the security controls addressed by this measure, and
measurement activities can refocus on other controls in need of improvement.
Example 2
For a new ISMS, the organization should first seek to ensure that top management attends the review
and other meetings that can be called. The planned (or intended) result in this case is full attendance
at all meetings, barring sickness and permitted prior commitments. The measure is simply how
many attend versus how many ought to attend, with a possible modifier that absence was for good
reason. At first, the results of these measures might indicate a shortfall. However, with time, results
should reach and remain close to their planned targets. At this point, the organization should begin
to focus its measurement efforts on effectiveness measures (see 7.3).
After most performance measures reach and remain at 100%, the organization should begin to focus its
measurement efforts on effectiveness measures. Organizations should never fully retire performance
measures because they can be helpful in pointing out specific security controls that are in need of
improvement; however, over time, the emphasis and resources being applied to measurement should
shift away from these measures and towards effectiveness measures (see 7.3).
According to ISO/IEC 27001:2013, 9.1, it is likewise important to also measure the effectiveness of
the management system (discussed next). To operate a suitable ISMS, organizations should measure
performance and effectiveness at planned intervals.
7.3 Effectiveness measures
Effectiveness measures should be used to describe the effectiveness and impact that the realisations of
the ISMS risk treatment plan and ISMS processes and controls have on the organization’s information
security objectives. These measures should be used to determine whether ISMS processes and
information security controls are operating as intended and achieving their desired outcomes.
Depending upon those objectives, effectiveness measures can be used to quantify, e.g.:
a) cost savings produced by the ISMS or through costs incurred from addressing information security
incidents;
b) the degree of customer trust gained/maintained by the ISMS; and
c) the achievement of other information security objectives.
Effectiveness measures can be created by combining data obtained from automated monitoring and
evaluation tools with manually-derived data about ISMS activity. This can require tracking a variety
of measures across the organization in a manner that can be directly tied to the ISMS activities and
information security events. To achieve this, an organization should have an established capability to:
d) evaluate the degree to which ISMS processes, controls, or groups of controls have been implemented
through performance measures;
e) collect data from automated monitoring and evaluation tools;
f) manually collect data from ISMS activities;
g) normalize and analyse data originating from multiple automated and manual sources; and
h) interpret and report this data to decision makers.
8 © ISO/IEC 2016 – All rights reserved

These effectiveness measures combine information about the realisation of the risk treatment plan
with a variety of information about resources and can provide inputs to the risk management process.
They can also provide the most direct insight into the value of information security to the organization
and can be the ones that ought to be of most interest to top management.
Example 3
Exploitations of known vulnerabilities are known to cause a large portion of information security
incidents. The greater the number of known vulnerabilities and the longer that they are not
addressed (e.g. patched), the greater the probability of their exploitation by associated threats and
the greater the related risk exposure. An effectiveness measure can help an organization determine
its risk exposure caused by such vulnerabilities.
Example 4
A training course can have specific training objectives for each course module. An effectiveness
measure can help the organization to determine the extent to which each trainee has understood
each lesson and is able to apply their new knowledge and skills. These measures usually require
multiple data points, such as: results of post-training tests; examination of incident data correlated
with training topics; or analysis of help desk calls correlated with training topics.
8 Processes
8.1 General
Monitoring, measurement, analysis and evaluation (see Figure 2) consists of the following processes:
a) identify information needs;
b) create and maintain measures;
c) establish procedures;
d) monitor and measure;
e) analyse results; and
f) evaluate information security performance and ISMS effectiveness.
In addition, there is an ISMS management process that covers the review and improvement of the above
processes, see 8.8.
© ISO/IEC 2016 – All rights reserved 9

Figure 2 — Monitoring, measurement, analysis and evaluation processes
8.2 Identify information needs
The creation of measures should begin with identification of information needs, which can assist in the
understanding of the operational characteristics and/or performance of any aspect of the ISMS, such as
any of the following:
a) interested party needs;
b) the strategic direction of the organization;
c) information security policy and objectives; and
d) the risk treatment plan.
The following activities should be performed to identify relevant information needs:
e) examine the ISMS, its processes and other elements such as:
1) information security policy and objectives, control objectives and controls;
2) legal, regulatory, contractual and organizational requirements for information security; and
3) the information security risk management process outcomes.
f) prioritize the identified information needs based on criteria, such as:
1) risk treatment priorities;
10 © ISO/IEC 2016 – All rights reserved

2) capabilities and resources of an organization;
3) interested party needs;
4) the information security policy and objectives, and control objectives;
5) information required to meet organizational, legal, regulatory, and contractual obligations; and
6) the value of the information to be obtained in relation to the cost of measurement;
g) select a subset of information needs required to be addressed in measurement activities from the
prioritized list; and
h) document and communicate the selected information needs to all relevant interested parties.
8.3 Create and maintain measures
8.3.1 General
Organizations should create measures once and thereafter review and systematically update these
measures at planned intervals or when the ISMS’s environment undergoes substantial changes. Such
changes can include, among others:
a) the scope of the ISMS;
b) organizational structure;
c) interested parties including interested party roles, responsibilities and authorities;
d) business objectives and requirements;
e) legal and regulatory requirements;
f) achievement of desired and stable results for several subsequent cycles; and
g) introduction or disposition of information processing technologies and systems.
Creating or updating such measures can include, among others, the followings steps:
h) identify current security practices that can support information needs;
i) develop or update measures;
j) document measures and define implementation priority; and
k) keep management informed and engaged.
Updating measures is expected to take less time and effort than the initial creation.
8.3.2 Identify current security practices that can support information needs
Once an information need is identified, organizations should inventory existing measurement and
security practices as a potential component of measurement. Existing measurement and security
practices can include measurement associated with:
a) risk management;
b) project management;
c) compliance reporting; and
d) security policies.
© ISO/IEC 2016 – All rights reserved 11

8.3.3 Develop or update measures
Measures should respond to the information need. They can rely on the current practices or they
need new ones. Newly identified measures can also involve an adaptation of existing measures or
measurement processes. In any case, the identified measures should be defined in sufficient detail to
enable these measures to be implemented.
Examples of data that can be collected to support security measures include:
a) output of various logs and scans;
b) statistics on training and other human resource activities;
c) relevant surveys and questionnaires;
d) incident statistics;
e) results of internal audits;
f) results of business continuity/disaster recovery exercises; and
g) reports from management reviews.
These and other potential sources of data, which can be of either of internal or external origin, should
be examined and types of available data identified.
The selected measures should support the priority of the information needs and can consider:
h) ease of data collection;
i) availability of human resources to collect and manage data;
j) availability of appropriate tools;
k) number of potentially relevant performance indicators supported by the measure;
l) ease of interpretation;
m) number of users of developed measurement results;
n) evidence showing the measure’s fitness for purpose or information need; and
o) costs of collecting, managing, and analysing the data.
Organizations should document each measure in a form that ties the measure to the relevant
information need (or needs) and provides sufficient information about the characteristics describing
the measure and how to collect, analyse, and report it. Suggested information descriptors are provided
in Table 1.
The examples in Annex B use Table 1 as a template. Two examples have an additional information
descriptor (called “action”), which defines the action to be taken in the event that the target is not met.
Organizations may include this information descriptor if they consider it useful. There is no single way
to specify such measurement constructs and Annex C demonstrates an altern
...

INTERNATIONAL ISO/IEC
STANDARD 27004
Second edition
2016-12-15
Information technology — Security
techniques — Information security
management — Monitoring,
measurement, analysis and evaluation
Technologies de l’information — Techniques de sécurité —
Management de la sécurité de l’information —
Surveillance, mesurage, analyse et évaluation
Reference number
©
ISO/IEC 2016
© ISO/IEC 2016, Published in Switzerland
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form
or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior
written permission. Permission can be requested from either ISO at the address below or ISO’s member body in the country of
the requester.
ISO copyright office
Ch. de Blandonnet 8 • CP 401
CH-1214 Vernier, Geneva, Switzerland
Tel. +41 22 749 01 11
Fax +41 22 749 09 47
copyright@iso.org
www.iso.org
ii © ISO/IEC 2016 – All rights reserved

Contents Page
Foreword .iv
Introduction .v
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Structure and overview . 1
5 Rationale . 2
5.1 The need for measurement . 2
5.2 Fulfilling the ISO/IEC 27001 requirements . 3
5.3 Validity of results . 3
5.4 Benefits . 3
6 Characteristics . 4
6.1 General . 4
6.2 What to monitor. 4
6.3 What to measure . 5
6.4 When to monitor, measure, analyse and evaluate . 6
6.5 Who will monitor, measure, analyse and evaluate . 6
7 Types of measures . 7
7.1 General . 7
7.2 Performance measures . 7
7.3 Effectiveness measures . 8
8 Processes . 9
8.1 General . 9
8.2 Identify information needs .10
8.3 Create and maintain measures .11
8.3.1 General.11
8.3.2 Identify current security practices that can support information needs .11
8.3.3 Develop or update measures .12
8.3.4 Document measures and prioritize for implementation .13
8.3.5 Keep management informed and engaged .13
8.4 Establish procedures .14
8.5 Monitor and measure .14
8.6 Analyse results .15
8.7 Evaluate information security performance and ISMS effectiveness .15
8.8 Review and improve monitoring, measurement, analysis and evaluation processes .15
8.9 Retain and communicate documented information .15
Annex A (informative) An information security measurement model .17
Annex B (informative) Measurement construct examples .19
Annex C (informative) An example of free-text form measurement construction .57
Bibliography .58
© ISO/IEC 2016 – All rights reserved iii

Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are
members of ISO or IEC participate in the development of International Standards through technical
committees established by the respective organization to deal with particular fields of technical
activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international
organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the
work. In the field of information technology, ISO and IEC have established a joint technical committee,
ISO/IEC JTC 1.
The procedures used to develop this document and those intended for its further maintenance are
described in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for
the different types of document should be noted. This document was drafted in accordance with the
editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).
Attention is drawn to the possibility that some of the elements of this document may be the subject
of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent
rights. Details of any patent rights identified during the development of the document will be in the
Introduction and/or on the ISO list of patent declarations received (see www.iso.org/patents).
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation on the meaning of ISO specific terms and expressions related to conformity assessment,
as well as information about ISO’s adherence to the World Trade Organization (WTO) principles in the
Technical Barriers to Trade (TBT) see the following URL: www.iso.org/iso/foreword.html.
The committee responsible for this document is ISO/IEC JTC 1, Information technology, Subcommittee
SC 27, IT Security techniques.
This second edition of ISO/IEC 27004 cancels and replaces the first edition (ISO/IEC 27004:2009),
which has been technically revised.
This edition includes the following significant changes with respect to the previous edition:
A total restructuring of the document because it has a new purpose – to provide guidance on
ISO/IEC 27001:2013, 9.1 – which, at the time of the previous edition, did not exist.
The concepts and processes have been modified and expanded. However, the theoretical foundation
(ISO/IEC 15939) remains the same and several of the examples given in the previous edition are
preserved, albeit updated.
iv © ISO/IEC 2016 – All rights reserved

Introduction
This document is intended to assist organizations to evaluate the information security performance
and the effectiveness of an information security management system in order to fulfil the requirements
of ISO/IEC 27001:2013, 9.1: monitoring, measurement, analysis and evaluation.
The results of monitoring and measurement of an information security management system (ISMS)
can be supportive of decisions relating to ISMS governance, management, operational effectiveness and
continual improvement.
As with other ISO/IEC 27000 documents, this document should be considered, interpreted and adapted
to suit each organization’s specific situation. The concepts and approaches are intended to be broadly
applicable but the particular measures that any particular organization requires depend on contextual
factors (such as its size, sector, maturity, information security risks, compliance obligations and
management style) that vary widely in practice.
This document is recommended for organizations implementing an ISMS that meets the requirements
of ISO/IEC 27001. However, it does not establish any new requirements for ISMS which conform to
ISO/IEC 27001 or impose any obligations upon organizations to observe the guidelines presented.
© ISO/IEC 2016 – All rights reserved v

INTERNATIONAL STANDARD ISO/IEC 27004:2016(E)
Information technology — Security techniques —
Information security management — Monitoring,
measurement, analysis and evaluation
1 Scope
This document provides guidelines intended to assist organizations in evaluating the information
security performance and the effectiveness of an information security management system in order to
fulfil the requirements of ISO/IEC 27001:2013, 9.1. It establishes:
a) the monitoring and measurement of information security performance;
b) the monitoring and measurement of the effectiveness of an information security management
system (ISMS) including its processes and controls;
c) the analysis and evaluation of the results of monitoring and measurement.
This document is applicable to all types and sizes of organizations.
2 Normative references
The following documents are referred to in the text in such a way that some or all of their content
constitutes requirements of this document. For dated references, only the edition cited applies. For
undated references, the latest edition of the referenced document (including any amendments) applies.
There are no normative references in this document.
3 Terms and definitions
For the purposes of this document, the terms and definitions given in ISO/IEC 27000 apply.
ISO and IEC maintain terminological databases for use in standardization at the following addresses:
— IEC Electropedia: available at http://www.electropedia.org/
— ISO Online browsing platform: available at http://www.iso.org/obp
4 Structure and overview
This document is structured as follows:
a) Rationale (Clause 5);
b) Characteristics (Clause 6);
c) Types of measures (Clause 7);
d) Processes (Clause 8).
The ordering of these clauses is intended to aid understanding and map to ISO/IEC 27001:2013, 9.1
requirements, as is illustrated in Figure 1.
Starting with the information needed to fulfil that requirement, referred to as information needs, the
organization determines the measures that it will use to fulfil those information needs. The process
© ISO/IEC 2016 – All rights reserved 1

of monitoring and measurement produces data which is then analysed. The results of analysis are
evaluated in fulfilment of the organization’s information needs.
In addition, Annex A describes a measurement model for information security, including the relationship
between the components of the measurement model and the requirements of ISO/IEC 27001:2013, 9.1.
Annex B provides a wide range of examples. These examples are intended to provide practical guidance
on how organizations can monitor, measure, analyse and evaluate their chosen ISMS processes and
areas of information security performance. These examples use the suggested template given in Table 1.
Annex C provides a further example using an alternative free-form text-based format.
Figure 1 — Mapping to ISO/IEC 27001:2013, 9.1 requirements
5 Rationale
5.1 The need for measurement
The overall objective of an ISMS is the preservation of confidentiality, integrity and availability of
information within its scope. There are ISMS activities that concern the planning of how to do this, and
the implementation of those plans. However, by themselves, these activities cannot guarantee that the
realisation of those plans fulfil the information security objectives. Therefore, in the ISMS as defined
by ISO/IEC 27001, there are several requirements to evaluate if the plans and activities ensure the
fulfilment of the information security objectives.
2 © ISO/IEC 2016 – All rights reserved

5.2 Fulfilling the ISO/IEC 27001 requirements
ISO/IEC 27001:2013, 9.1 requires the organization to evaluate the information security performance
and the effectiveness of the ISMS. Measure types able to fulfil these requirements can be found in
Clause 7.
ISO/IEC 27001:2013, 9.1 further requires the organization to determine:
a) what needs to be monitored and measured, including information security processes and controls;
b) the methods for monitoring, measurement, analysis and evaluation, as applicable, to ensure valid
results;
c) when the monitoring and measuring shall be performed;
d) who shall monitor and measure;
e) when the results from monitoring and measurement shall be analysed and evaluated; and
f) who shall analyse and evaluate these results.
The mapping of these requirements is provided in Figure 1.
Finally, ISO/IEC 27001:2013, 9.1 requires the organization to retain appropriate documented
information as evidence of the monitoring and measurement results (See 8.9).
ISO/IEC 27001:2013, 9.1 also notes that methods selected should produce comparable and reproducible
results in order for them to be considered valid (See 6.4).
5.3 Validity of results
ISO/IEC 27001:2013, 9.1 b) requires that organizations choose methods for measurement, monitoring,
analysis and evaluation to ensure valid results. The clause notes that to be valid, results should
be comparable and reproducible. To achieve this, organizations should collect, analyse, and report
measures, taking the following points into consideration:
a) in order to get comparable results on measures that are based on monitoring at different points in
times, it is important to ensure that scope and context of the ISMS are not changed;
b) changes in the methods or techniques used for measuring and monitoring do not generally lead to
comparable results. In order to retain comparability, specific tests such as parallel application of
the original as well as the changed methods can be required;
c) if subjective elements are part of the methods or techniques used for measuring and monitoring,
specific steps can be needed to obtain reproducible results. As an example, questionnaire results
should be evaluated against defined criteria; and
d) in some situations, reproducibility can only be given in specific circumstances. For example, there
are situations where results are non-reproducible, but are valid when aggregated.
5.4 Benefits
Fulfilling ISMS processes and controls and ensuring information security performance can provide a
number of organizational and financial benefits. Major benefits can include:
a) Increased accountability: Monitoring, measurement, analysis and evaluation can increase
accountability for information security by helping to identify specific information security
processes or controls that are implemented incorrectly, are not implemented, or are ineffective.
b) Improved information security performance and ISMS processes: Monitoring, measurement,
analysis and evaluation can enable organizations to quantify improvements in securing information
© ISO/IEC 2016 – All rights reserved 3

within the scope of their ISMS and demonstrate quantifiable progress in accomplishing the
organization’s information security objectives.
c) Evidence of meeting requirements: Monitoring, measurement, analysis and evaluation can
provide documented evidence that helps demonstrate fulfilling of ISO/IEC 27001 (and other
standards) requirements, as well as applicable laws, rules, and regulations.
d) Support decision-making: Monitoring, measurement, analysis and evaluation can support risk-
informed decision-making by contributing quantifiable information to the risk management
process. It can allow organizations to measure successes and failures of past and current
information security investments, and should provide quantifiable data that can support resource
allocation for future investments.
6 Characteristics
6.1 General
Monitoring and measurement is the first step in a process to evaluate information security performance
and ISMS effectiveness.
Faced with a potentially overwhelming variety of attributes of information security-related entities
that can be measured, it is not entirely obvious which ones should be measured. This is an important
issue because it is impracticable, costly and counterproductive to measure too many or the wrong
attributes. Aside from the obvious costs of measuring, analysing and reporting numerous attributes,
there is a distinct possibility that key issues can be obscured within a large volume of information or
missed altogether if suitable measures are not in place.
In order to determine what to monitor and measure, the organization should first consider what it
wishes to achieve in evaluating information security performance and ISMS effectiveness. This can
allow it to determine its information needs.
Organizations should next decide what measures are needed to support each discrete information
need and what data are required to derive the requisite measures. Hence, measurement should always
correspond to the information needs of the organization.
6.2 What to monitor
Monitoring determines the status of a system, a process or an activity in order to meet a specified
information need.
Systems, processes and activities which can be monitored include, but are not limited to:
a) implementation of ISMS processes;
b) incident management;
c) vulnerability management;
d) configuration management;
e) security awareness and training;
f) access control, firewall and other event logging;
g) audit;
h) risk assessment process;
i) risk treatment process;
j) third party risk management;
4 © ISO/IEC 2016 – All rights reserved

k) business continuity management;
l) physical and environmental security management; and
m) system monitoring.
These monitoring activities produce data (event logs, user interviews, training statistics, incident
information, etc.) that can be used to support other measures. In the process of defining attributes to be
measured, additional monitoring can be required to provide supporting information.
Note that monitoring can allow an organization to determine whether a risk has materialized, and
thereby indicate what action it can take to treat such a risk itself. Note also that there can be certain
types of information security controls that have the explicit purpose of monitoring. When using outputs
of such controls to support measurement, organizations should ensure that the measurement process
takes into account whether the data used was obtained before or after any treatment action was taken.
6.3 What to measure
Measurement is an activity undertaken to determine a value, status or trend in performance or
effectiveness to help identify potential improvement needs. Measurement can be applied to any ISMS
processes, activities, controls and groups of controls.
As an example, consider ISO/IEC 27001:2013, 7.2 c), which requires an organization to take action, where
applicable, to acquire necessary competence. An organization can determine whether all individuals
who require training have received it and whether the training was delivered as planned. This can be
measured by the number or percentage of people trained. An organization can also determine whether
the individuals who have been trained actually acquired and retained the necessary competence (which
can be measured with a post-training questionnaire).
With regards to ISMS processes, organizations should note that there are a number of clauses in
ISO/IEC 27001 that explicitly require the effectiveness of some activity to be determined. For example,
ISO/IEC 27001:2013, 10.1 d) requires organizations to “review the effectiveness of any corrective
action taken”. In order to perform such a review, the effectiveness of corrective actions should first be
determined in terms of some defined form of measure. In order to do this the organization should first
define an appropriate information need and a measure, or measures, to satisfy it. The process for doing
this is explained in Clause 8.
ISMS processes and activities that are candidates for measurement include:
a) planning;
b) leadership;
c) risk management;
d) policy management;
e) resource management;
f) communicating;
g) management review;
h) documenting; and
i) auditing.
With regards to information security performance, the most obvious candidates are the organization’s
information security controls or groups of such controls (or even the entire risk treatment plan). These
controls are determined through the process of risk treatment and are referred to in ISO/IEC 27001 as
necessary controls. They can be ISO/IEC 27001:2013, Annex A controls, sector-specific controls (e.g. as
defined in standards such as ISO/IEC 27010), controls specified by other standards and controls that
© ISO/IEC 2016 – All rights reserved 5

have been designed by the organization. As the purpose of a control is to modify risk, there are a variety
of attributes that can be measured, such as:
j) the degree to which a control reduces the likelihood of the occurrence of an event;
k) the degree to which a control reduces the consequence of an event;
l) the frequency of events that a control can cope with before failure; and
m) how long after the occurrence of an event does it take for the control to detect that the event has
occurred.
6.4 When to monitor, measure, analyse and evaluate
Organizations should define specific timeframes in which to monitor, measure, analyse, and evaluate,
based on individual information needs, required measures, and the lifecycle of data supporting
individual measures. The data supporting measures can be collected more frequently than the analysis
and reporting of such measures to individual interested parties. For example, while data on security
incidents can be collected continually, reporting of such data to external interested parties should be
based on specific requirements, such as severity (possibly requiring immediate notification as in the
case of a reportable breach) or aggregated values (as might be the case for attempted intrusions which
were detected and blocked).
Organizations should note that in order to satisfy certain information needs, before analysis and
evaluation can proceed, an appropriate volume of data needs to be collected in order to provide
a meaningful basis for assessment and comparison (e.g. when conducting statistical analysis). In
addition, the processes of monitoring, measurement, analysis, and evaluation can need testing and
fine-tuning before the resulting measures can be useful to the organization. Organizations should
therefore determine a limit to the duration of any fine-tuning (so as to proceed with the real objective,
measurement of the ISMS) and for how long monitoring and collection should continue before analysis
and evaluation can commence.
Organizations can adjust their measurement timeframes, as they update their measurement activities,
to address specific environmental changes listed in 8.2. For example, if an organization is transitioning
from a manual data source to an automated source, a change in frequency of collection can be required.
Furthermore, a baseline is needed to compare two sets of measures taken at different points in time
and potentially by different methods but aiming to fulfil the same information need.
An organization can choose to structure their monitoring, measurement, analysis, and evaluation
activities into a measurement programme. It is important to note, however, that ISO/IEC 27001 has no
requirement for organizations to have such a programme.
6.5 Who will monitor, measure, analyse and evaluate
Organizations (considering requirements of ISO/IEC 27001:2013, 9.1 and 5.3) should specify who
monitors, measures, analyses and evaluates in terms of individuals or roles. Monitoring, measurement,
analysis, and evaluation can be performed using either manual or automated means. Whether
the measurement is performed manually or automatically, organizations can define the following
measurement-related roles and responsibilities:
a) measurement client: the management or other interested parties requesting or requiring
information about the effectiveness of an ISMS, controls or group of controls;
b) measurement planner: the person or organizational unit that defines the measurement constructs
that links measurable attributes to a specified information need;
c) measurement reviewer: the person or organizational unit that validates that the developed
measurement constructs are appropriate for evaluating information security performance and the
effectiveness of an ISMS, controls or group of controls;
6 © ISO/IEC 2016 – All rights reserved

d) information owner: the person or organizational unit that owns the information that provides
input into measures. This person is responsible for providing the data and is also frequently (but
not always) responsible for conducting measurement activities;
e) information collector: the person or organizational unit responsible for collecting, recording and
storing the data;
f) information analyst: the person or organizational unit responsible for analysing data; and
g) information communicator: the person or organizational unit responsible for communicating the
results of analysis.
Organizations can combine some, or possibly all, of these roles.
Individuals performing different roles and responsibilities throughout the processes can require
diverse skill sets and associated awareness and training.
7 Types of measures
7.1 General
For the purposes of this guidance, the performance of planned activities and the effectiveness of the
results can be measured by applying the two following types of measures:
a) performance measures: measures that express the planned results in terms of the characteristics
of the planned activity, such as head counts, milestone accomplishment, or the degree to which
information security controls have been implemented;
b) effectiveness measures: measures that express the effect that realization of the planned activities
has on the organization’s information security objectives.
These measures can be inherently organization-specific since each organization has its own particular
information security objectives, policies and requirements.
Note that the terms “performance measures” and “effectiveness measures” should not be confused
with the ISO/IEC 27001:2013, 9.1 requirement to evaluate information security performance and ISMS
effectiveness.
7.2 Performance measures
Performance measures can be used to demonstrate progress in implementing ISMS processes, associated
procedures and specific security controls. Whereas effectiveness concerns the extent to which planned
activities have been realised and intended results achieved, performance measures should concern the
extent to which information security processes and controls have been implemented. These measures
help determine whether the ISMS processes and information security controls have been implemented
as specified.
Performance measures use data that can be obtained from minutes, attendance records, project plans,
automated scanning tools and other commonly-used means of documenting, recording, and monitoring
ISMS activities.
The collection, analysis, and reporting of measures should be automated wherever possible, in order to
reduce the cost and effort required and the potential for human error.
© ISO/IEC 2016 – All rights reserved 7

Example 1
When measuring the degree of implementation of specific information security controls, such as
the percentage of laptops with hard disk encryption, the results of this measure will likely be, at
first, less than 100%. When the result reaches and remains at 100%, it can be concluded that the
information systems have fully implemented the security controls addressed by this measure, and
measurement activities can refocus on other controls in need of improvement.
Example 2
For a new ISMS, the organization should first seek to ensure that top management attends the review
and other meetings that can be called. The planned (or intended) result in this case is full attendance
at all meetings, barring sickness and permitted prior commitments. The measure is simply how
many attend versus how many ought to attend, with a possible modifier that absence was for good
reason. At first, the results of these measures might indicate a shortfall. However, with time, results
should reach and remain close to their planned targets. At this point, the organization should begin
to focus its measurement efforts on effectiveness measures (see 7.3).
After most performance measures reach and remain at 100%, the organization should begin to focus its
measurement efforts on effectiveness measures. Organizations should never fully retire performance
measures because they can be helpful in pointing out specific security controls that are in need of
improvement; however, over time, the emphasis and resources being applied to measurement should
shift away from these measures and towards effectiveness measures (see 7.3).
According to ISO/IEC 27001:2013, 9.1, it is likewise important to also measure the effectiveness of
the management system (discussed next). To operate a suitable ISMS, organizations should measure
performance and effectiveness at planned intervals.
7.3 Effectiveness measures
Effectiveness measures should be used to describe the effectiveness and impact that the realisations of
the ISMS risk treatment plan and ISMS processes and controls have on the organization’s information
security objectives. These measures should be used to determine whether ISMS processes and
information security controls are operating as intended and achieving their desired outcomes.
Depending upon those objectives, effectiveness measures can be used to quantify, e.g.:
a) cost savings produced by the ISMS or through costs incurred from addressing information security
incidents;
b) the degree of customer trust gained/maintained by the ISMS; and
c) the achievement of other information security objectives.
Effectiveness measures can be created by combining data obtained from automated monitoring and
evaluation tools with manually-derived data about ISMS activity. This can require tracking a variety
of measures across the organization in a manner that can be directly tied to the ISMS activities and
information security events. To achieve this, an organization should have an established capability to:
d) evaluate the degree to which ISMS processes, controls, or groups of controls have been implemented
through performance measures;
e) collect data from automated monitoring and evaluation tools;
f) manually collect data from ISMS activities;
g) normalize and analyse data originating from multiple automated and manual sources; and
h) interpret and report this data to decision makers.
8 © ISO/IEC 2016 – All rights reserved

These effectiveness measures combine information about the realisation of the risk treatment plan
with a variety of information about resources and can provide inputs to the risk management process.
They can also provide the most direct insight into the value of information security to the organization
and can be the ones that ought to be of most interest to top management.
Example 3
Exploitations of known vulnerabilities are known to cause a large portion of information security
incidents. The greater the number of known vulnerabilities and the longer that they are not
addressed (e.g. patched), the greater the probability of their exploitation by associated threats and
the greater the related risk exposure. An effectiveness measure can help an organization determine
its risk exposure caused by such vulnerabilities.
Example 4
A training course can have specific training objectives for each course module. An effectiveness
measure can help the organization to determine the extent to which each trainee has understood
each lesson and is able to apply their new knowledge and skills. These measures usually require
multiple data points, such as: results of post-training tests; examination of incident data correlated
with training topics; or analysis of help desk calls correlated with training topics.
8 Processes
8.1 General
Monitoring, measurement, analysis and evaluation (see Figure 2) consists of the following processes:
a) identify information needs;
b) create and maintain measures;
c) establish procedures;
d) monitor and measure;
e) analyse results; and
f) evaluate information security performance and ISMS effectiveness.
In addition, there is an ISMS management process that covers the review and improvement of the above
processes, see 8.8.
© ISO/IEC 2016 – All rights reserved 9

Figure 2 — Monitoring, measurement, analysis and evaluation processes
8.2 Identify information needs
The creation of measures should begin with identification of information needs, which can assist in the
understanding of the operational characteristics and/or performance of any aspect of the ISMS, such as
any of the following:
a) interested party needs;
b) the strategic direction of the organization;
c) information security policy and objectives; and
d) the risk treatment plan.
The following activities should be performed to identify relevant information needs:
e) examine the ISMS, its processes and other elements such as:
1) information security policy and objectives, control objectives and controls;
2) legal, regulatory, contractual and organizational requirements for information security; and
3) the information security risk management process outcomes.
f) prioritize the identified information needs based on criteria, such as:
1) risk treatment priorities;
10 © ISO/IEC 2016 – All rights reserved

2) capabilities and resources of an organization;
3) interested party needs;
4) the information security policy and objectives, and control objectives;
5) information required to meet organizational, legal, regulatory, and contractual obligations; and
6) the value of the information to be obtained in relation to the cost of measurement;
g) select a subset of information needs required to be addressed in measurement activities from the
prioritized list; and
h) document and communicate the selected information needs to all relevant interested parties.
8.3 Create and maintain measures
8.3.1 General
Organizations should create measures once and thereafter review and systematically update these
measures at planned intervals or when the ISMS’s environment undergoes substantial changes. Such
changes can include, among others:
a) the scope of the ISMS;
b) organizational structure;
c) interested parties including interested party roles, responsibilities and authorities;
d) business objectives and requirements;
e) legal and regulatory requirements;
f) achievement of desired and stable results for several subsequent cycles; and
g) introduction or disposition of information processing technologies and systems.
Creating or updating such measures can include, among others, the followings steps:
h) identify current security practices that can support information needs;
i) develop or update measures;
j) document measures and define implementation priority; and
k) keep management informed and engaged.
Updating measures is expected to take less time and effort than the initial creation.
8.3.2 Identify current security practices that can support information needs
Once an information need is identified, organizations should inventory existing measurement and
security practices as a potential component of measurement. Existing measurement and security
practices can include measurement associated with:
a) risk management;
b) project management;
c) compliance reporting; and
d) security policies.
© ISO/IEC 2016 – All rights reserved 11

8.3.3 Develop or update measures
Measures should respond to the information need. They can rely on the current practices or they
need new ones. Newly identified measures can also involve an adaptation of existing measures or
measurement processes. In any case, the identified measures should be defined in sufficient detail to
enable these measures to be implemented.
Examples of data that can be collected to support security measures include:
a) output of various logs and scans;
b) statistics on training and other human resource activities;
c) relevant surveys and questionnaires;
d) incident statistics;
e) results of internal audits;
f) results of business continuity/disaster recovery exercises; and
g) reports from management reviews.
These and other potential sources of data, which can be of either of internal or external origin, should
be examined and types of available data identified.
The selected measures should support the priority of the information needs and can consider:
h) ease of data collection;
i) availability of human resources to collect and manage data;
j) availability of appropriate tools;
k) number of potentially relevant performance indicators supported by the measure;
l) ease of interpretation;
m) number of users of developed measurement results;
n) evidence showing the measure’s fitness for purpose or information need; and
o) costs of collecting, managing, and analysing the data.
Organizations should document each measure in a form that ties the measure to the relevant
information need (or needs) and provides sufficient information about the characteristics describing
the measure and how to collect, analyse, and report it. Suggested information descriptors are provided
in Table 1.
The examples in Annex B use Table 1 as a template. Two examples have an additional information
descriptor (called “action”), which defines the action to be taken in the event that the target is not met.
Organizations may include this information descriptor if they consider it useful. There is no single way
to specify such measurement constructs and Annex C demonstrates an alternative free-form approach.
It should be noted that different measures may need to be provided to meet the needs of different
measurement clients (see Table 1), which can be internal or external. For example, measures for
addressing top management information needs can differ from those for system administrator
consumption (e.g. either interested party can have a specific range or focus, or granularity).
Each measure should correspond to, at least, one information need, while a single information need
might require several measures.
Organizations should take care when using subjective measures as measures formed by combining two
or more subjective measures can adversely affect the final result.
12 © ISO/IEC 2016 – All rights reserved

Table 1 — Example security measure descriptors
Information
Meaning or purpose
descriptor
Measure ID Specific identifier.
Information need Over-arching need for understanding to which the measure contributes.
Statement of measurement, generally described using a word such as “percentage”,
Measure
“number”, “frequency” and “average”.
Formula/scoring How the measure should be evaluated, calculated or scored.
Desired result of the measurement, e.g., a milestone or a statistical measure or a set of
Target thresholds. Note that ongoing monitoring can be required to ensure continued attainment
of
...

SL O V EN S K I SIST ISO/IEC 27004

S T ANDAR D
november 2018
Informacijska tehnologija – Varnostne tehnike – Vodenje informacijske
varnosti – Spremljanje, merjenje, analiza in vrednotenje

Information technology – Security techniques – Information security management
– Monitoring, measurement, analysis and evaluation

Technologies de l'information – Techniques de sécurité – Management de la
sécurité de l'information – Surveillance, mesurage, analyse et évaluation

Referenčna oznaka
ICS 03.100.70; 35.030 SIST ISO/IEC 27004:2018 (sl)

Nadaljevanje na straneh 2 do 65

© 2026-03. Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

SIST ISO/IEC 27004 : 2018
NACIONALNI UVOD
Standard SIST ISO/IEC 27004 (sl), Informacijska tehnologija – Varnostne tehnike – Vodenje
informacijske varnosti – Spremljanje, merjenje, analiza in vrednotenje, 2018, ima status slovenskega
standarda in je istoveten z mednarodnim standardom ISO/IEC 27004 (en, fr), Information technology –
Security techniques – Information security management – Monitoring, measurement, analysis and
evaluation, 2016.
NACIONALNI PREDGOVOR
Besedilo standarda ISO/IEC 27004:2016 je pripravil združeni tehnični odbor Mednarodne organizacije
za standardizacijo (ISO) in Mednarodne elektrotehniške komisije (IEC) ISO/IEC JTC 1 Informacijska
tehnologija. Slovenski standard SIST ISO/IEC 27004:2018 je prevod angleškega besedila
mednarodnega standarda ISO/IEC 27004:2016. V primeru spora glede besedila slovenskega prevoda
v tem standardu je odločilen izvirni mednarodni standard v angleškem jeziku. Slovensko izdajo
standarda je pripravil SIST/TC ITC Informacijska tehnologija.

Odločitev za privzem tega standarda je dne 1. novembra 2018 sprejel SIST/TC ITC Informacijska
tehnologija.
ZVEZA Z NACIONALNIMI STANDARDI

OSNOVA ZA IZDAJO STANDARDA
̶ privzem standarda ISO/IEC 27004:2016

PREDHODNA IZDAJA
̶ SIST ISO/IEC 27004:2011, Informacijska tehnologija – Varnostne tehnike – Upravljanje
informacijske varnosti – Merjenje

OPOMBE
‒ Povsod, kjer se v besedilu standarda uporablja izraz “mednarodni standard”, v SIST ISO/IEC
27004:2018 to pomeni “slovenski standard”.

‒ Nacionalni uvod in nacionalni predgovor nista sestavni del standarda.

‒ Neustrezno označena imena primerov konstruktov merjenja v besedilu od B.31 na str. 57 do B.37
na str. 63 v primerjavi s preglednico imen konstruktov merjenja v B.1 Splošno k dodatku B.

‒ Napaka pri povezavi na točke ali številke ciljev kontrol v ISO/IEC 27001:2013 pri konstruktih
merjenja B.11 (str. 36), B.13 (str. 39) in B.28 (str. 54).

SIST ISO/IEC 27004 : 2018
Vsebina Stran
Predgovor k mednarodnemu standardu . 5
Uvod .6
1 Področje uporabe . 7
2 Zveze s standardi . 7
3 Izrazi in definicije . 7
4 Struktura in pregled . 7
5 Utemeljitev .8
5.1 Potreba po merjenju. 8
5.2 Izpolnjevanje zahtev standarda ISO/IEC 27001 . 8
5.3 Veljavnost rezultatov . 9
5.4 Koristi . 9
6 Lastnosti . 10
6.1 Splošno . 10
6.2 Kaj spremljati . 10
6.3 Kaj meriti . 11
6.4 Kdaj spremljati, meriti, analizirati in vrednotiti . 12
6.5 Kdo bo spremljal, meril, analiziral in vrednotil . 12
7 Vrste meril . 13
7.1 Splošno . 13
7.2 Merila učinkovitosti delovanja . 13
7.3 Merila uspešnosti . 14
8 Procesi . 15
8.1 Splošno . 15
8.2 Prepoznavanje potreb po informacijah . 16
8.3 Ustvarjanje in vzdrževanje meril . 17
8.3.1 Splošno . 17
8.3.2 Opredelitev trenutnih varnostnih praks, ki lahko podpirajo potrebe po informacijah . 17
8.3.3 Oblikovanje ali posodabljanje meril . 18
8.3.4 Dokumentiranje meril in prednostna razvrstitev za izvajanje . 19
8.3.5 Obveščanje in vključevanje vodstva . 20
8.4 Vzpostavitev postopkov . 20
8.5 Spremljanje in merjenje . 20
8.6 Analiza rezultatov . 21
8.7 Vrednotenje delovanja informacijske varnosti in uspešnosti sistema vodenja informacijske
varnosti. 21
8.8 Pregled in izboljšanje procesov spremljanja, merjenja, analiziranja in vrednotenja . 21
8.9 Hranjenje in sporočanje dokumentiranih informacij . 21
Dodatek A (informativni) Model merjenja informacijske varnosti . 23

SIST ISO/IEC 27004 : 2018
Dodatek B (informativni) Primeri konstrukta merjenja . 25
Dodatek C (informativni) Primer strukture merjenja v obliki prostega besedila . 64
Viri in literatura . 65

SIST ISO/IEC 27004 : 2018
Predgovor k mednarodnemu standardu

ISO (Mednarodna organizacija za standardizacijo) in IEC (Mednarodna elektrotehniška komisija)
tvorita specializiran sistem za svetovno standardizacijo. Nacionalni organi, ki so člani ISO ali IEC,
sodelujejo pri pripravi mednarodnih standardov prek tehničnih odborov, ki jih za obravnavanje
določenih strokovnih področij ustanovi ustrezna organizacija. Tehnični odbori ISO in IEC sodelujejo na
področjih skupnega interesa. Pri delu sodelujejo tudi druge mednarodne, vladne in nevladne
organizacije, povezane z ISO in IEC. Na področju informacijske tehnologije sta ISO in IEC ustanovila
združeni tehnični odbor ISO/IEC JTC 1.

Postopki, uporabljeni pri pripravi tega dokumenta, in predvideni postopki za njegovo vzdrževanje so
opisani v 1. delu Direktiv ISO/IEC. Posebna pozornost naj se nameni različnim kriterijem odobritve,
potrebnim za različne vrste dokumentov. Ta dokument je bil zasnovan v skladu z uredniškimi pravili 2.
dela Direktiv ISO/IEC (glej www.iso.org/directives).

Opozoriti je treba na možnost, da bi lahko bil kateri od elementov tega dokumenta predmet patentnih
pravic. ISO in IEC nista odgovorna za identificiranje katerekoli ali vseh takih patentnih pravic.
Podrobnosti o morebitnih patentnih pravicah, identificiranih med pripravo tega dokumenta, bodo
navedene v uvodu in/ali na seznamu patentnih izjav, ki jih je prejela organizacija ISO (glej
www.iso.org/patents).
Vsakršna trgovska imena, uporabljena v tem dokumentu, so informacije za uporabnike in ne pomenijo
podpore blagovni znamki.
Za razlago pomena specifičnih pojmov in izrazov ISO, povezanih z ugotavljanjem skladnosti, ter
informacij o tem, kako ISO spoštuje načela Svetovne trgovinske organizacije (WTO) v Tehničnih
ovirah pri trgovanju (TBT), glej naslednji naslov URL: www.iso.org/iso/foreword.html.

Za ta dokument je pristojen tehnični odbor ISO/IEC JTC 1, Informacijska tehnologija, pododbor SC 27,
Varnostne tehnike IT.
Ta druga izdaja standarda ISO/IEC 27004 razveljavlja in nadomešča prvo izdajo
(ISO/IEC 27004:2009), ki je tehnično revidirana.

Ta izdaja v primerjavi s prejšnjo vključuje naslednje pomembne spremembe:

Popolno prestrukturiranje dokumenta, saj ima nov namen – podati smernice za točko 9.1 v
ISO/IEC 27001:2013 –, ki pri prejšnji izdaji ni obstajala.

Koncepti in postopki so bili spremenjeni ter razširjeni. Teoretična osnova (ISO/IEC 15939) sicer ostaja
enaka, številni primeri iz prejšnje izdaje pa so ohranjeni, čeprav posodobljeni.

SIST ISO/IEC 27004 : 2018
Uvod
Namen tega dokumenta je pomagati organizacijam ovrednotiti delovanje informacijske varnosti in
uspešnosti sistema vodenja informacijske varnosti za namene izpolnitve zahtev točke 9.1 v
ISO/IEC 27001:2013: spremljanje, merjenje, analiziranje in vrednotenje.

Rezultati spremljanja in merjenja sistema vodenja informacijske varnosti (ISMS) lahko podpirajo
odločitve v zvezi z upravljanjem, vodenjem, uspešnostjo delovanja in nenehnim izboljševanjem
sistema ISMS.
Kot pri drugih dokumentih ISO/IEC 27000 naj se tudi ta dokument upošteva, razlaga in prilagodi
posebnim razmeram v posamezni organizaciji. Koncepti in pristopi so namenjeni široki uporabi, vendar
so posamezna merila, ki jih zahteva posamezna organizacija, odvisna od kontekstualnih dejavnikov
(kot so velikost, sektor, zrelost, tveganja informacijske varnosti, obveznosti glede skladnosti in način
vodenja), ki se v praksi zelo razlikujejo.

Ta dokument je priporočljiv za organizacije, ki uvajajo sistem vodenja informacijske varnosti, ki
izpolnjuje zahteve standarda ISO/IEC 27001. Vendar pa ne določa nobenih novih zahtev za sisteme
vodenja informacijske varnosti, ki so skladne s standardom ISO/IEC 27001, in organizacijam ne
nalaga nobenih obveznosti glede upoštevanja predstavljenih smernic.

SIST ISO/IEC 27004 : 2018
Informacijska tehnologija – Varnostne tehnike – Vodenje informacijske varnosti
– Spremljanje, merjenje, analiza in vrednotenje

1 Področje uporabe
Ta dokument podaja smernice za pomoč organizacijam pri vrednotenju delovanja informacijske
varnosti in uspešnosti sistema vodenja informacijske varnosti za namene izpolnitve zahtev točke 9.1 v
ISO/IEC 27001:2013. Določa:
a) spremljanje in merjenje delovanja informacijske varnosti,

b) spremljanje in merjenje uspešnosti sistema vodenja informacijske varnosti (ISMS), vključno z
njegovimi procesi in kontrolami,

c) analizo ter vrednotenje rezultatov spremljanja in merjenja.

Ta dokument se uporablja za vse vrste in velikosti organizacij.

2 Zveze s standardi
Naslednji dokumenti so navedeni v besedilu na način, da njihov del ali celotna vsebina predstavlja
zahteve tega dokumenta. Pri datiranih sklicevanjih se uporablja le navedena izdaja. Pri nedatiranih
sklicevanjih se uporablja zadnja izdaja navedenega dokumenta (vključno z dopolnili).

Ta dokument ne vsebuje zvez s standardi.

3 Izrazi in definicije
V tem dokumentu so uporabljeni izrazi in definicije, podani v standardu ISO/IEC 27000.

ISO in IEC hranita terminološke podatkovne zbirke za uporabo pri standardizaciji na naslednjih
naslovih:
‒ IEC Electropedia: na voljo na http://www.electropedia.org/

‒ Platforma za spletno brskanje ISO: na voljo na http://www. iso.org/obp

4 Struktura in pregled
Ta dokument ima naslednjo strukturo:

a) Utemeljitev (točka 5),
b) Lastnosti (točka 6),
c) Vrste meril (točka 7),
d) Procesi (točka 8).
Razporeditev teh točk je namenjena lažjemu razumevanju in ustreza zahtevam 9.1 standarda
ISO/IEC 27001:2013, kot je prikazano na sliki 1.

Organizacija začne z informacijami, potrebnimi za izpolnitev te zahteve, imenovanimi potrebe po
informacijah, nato pa določi merila, ki jih bo uporabila za izpolnitev teh potreb po informacijah. S
spremljanjem in merjenjem se pridobivajo podatki, ki se nato analizirajo. Rezultati analize se
ovrednotijo z vidika izpolnjevanja potreb po informacijah organizacije.

Poleg tega je v dodatku A opisan model merjenja informacijske varnosti, vključno z razmerjem med
komponentami modela merjenja in zahtevami točke 9.1 v ISO/IEC 27001:2013.

SIST ISO/IEC 27004 : 2018
V dodatku B je na voljo širok nabor primerov. Ti primeri so namenjeni zagotavljanju praktičnih smernic,
kako lahko organizacije spremljajo, merijo, analizirajo ter ovrednotijo izbrane procese sistema vodenja
informacijske varnosti in območja delovanja informacijske varnosti. V teh primerih je uporabljena
predlagana predloga iz preglednice 1. V dodatku C je naveden dodaten primer z uporabo alternativne
besedilne oblike zapisa v prosti obliki.

Točka 9.1 v
Točke v ISO/IEC 27004:2016
ISO/IEC 27001:2013
a) Kaj spremljati in 6.2 Kaj spremljati
meriti
6.3 Kaj meriti
c) Kdaj spremljati in
meriti
6.4 Kdaj spremljati,
meriti, analizirati in
e) Kdaj naj se vrednotiti
rezultati analizirajo
Dodatek B: Primeri
in vrednotijo
konstruktov
merjenja
Dodatek C: Primer
d) Kdo mora
strukture merjenja v
spremljati in meriti
obliki prostega
6.5 Kdo bo
besedila
spremljal, meril,
f) Kdo mora
analiziral in vrednotil
analizirati in
ovrednotiti rezultate
7 Vrste meril
8 Procesi
b) Metode
spremljanja,
merjenja, analize in
Dodatek A: Model
vrednotenja
merjenja
informacijske varnosti
Slika 1: Preslikava na zahteve točke 9.1 v ISO/IEC 27001:2013

5 Utemeljitev
5.1 Potreba po merjenju
Splošni cilj sistema vodenja informacijske varnosti je ohranjanje zaupnosti, celovitosti in
razpoložljivosti informacij v njegovem obsegu. Obstajajo aktivnosti sistema vodenja informacijske
varnosti, ki se navezujejo na načrtovanje, kako to storiti, in na izvajanje teh načrtov. A te aktivnosti
same po sebi ne morejo zagotoviti, da realizacija teh načrtov izpolnjuje cilje informacijske varnosti.
Zato je v sistemu vodenja informacijske varnosti, kot ga opredeljuje standard ISO/IEC 27001, več
zahtev za ovrednotenje, ali načrti in aktivnosti zagotavljajo izpolnjevanje ciljev informacijske varnosti.

5.2 Izpolnjevanje zahtev standarda ISO/IEC 27001

Točka 9.1 v ISO/IEC 27001:2013 zahteva, da organizacija ovrednoti delovanje informacijske varnosti
in uspešnost sistema vodenja informacijske varnosti. Vrste meril, ki lahko izpolnijo te zahteve, so
navedene v točki 7.
Točka 9.1 v ISO/IEC 27001:2013 zahteva tudi, da organizacija določi:

a) katere potrebe morajo biti spremljane in merjene, vključno s procesi in kontrolami informacijske

SIST ISO/IEC 27004 : 2018
varnosti,
b) metode za spremljanje, merjenje, analizo in vrednotenje, če je potrebno, da se zagotovijo veljavni
rezultati,
c) kdaj se morata izvajati spremljanje in merjenje,

d) kdo mora spremljati in meriti,

e) kdaj se morajo analizirati in vrednotiti rezultati spremljanja in merjenja; ter

f) kdo mora analizirati in ovrednotiti te rezultate.

Preslikava teh zahtev je na voljo na sliki 1.

Točka 9.1 v ISO/IEC 27001:2013 nazadnje zahteva, da organizacija hrani ustrezne dokumentirane
informacije kot dokaz o rezultatih spremljanja in merjenja (glej 8.9).

Točka 9.1 v ISO/IEC 27001:2013 navaja tudi, da naj izbrane metode zagotovijo primerljive in
ponovljive rezultate, da se lahko ti štejejo za veljavne (glej 6.4).

5.3 Veljavnost rezultatov
Točka 9.1 b) v ISO/IEC 27001:2013 zahteva, da organizacije izberejo metode za spremljanje,
merjenje, analizo in vrednotenje, ki zagotavljajo veljavne rezultate. V točki je navedeno, da naj bodo
rezultati primerljivi in ponovljivi, da bodo veljavni. V ta namen naj organizacije zberejo, analizirajo in
sporočijo merila ter pri tem upoštevajo naslednje točke:

a) za pridobivanje primerljivih rezultatov glede meril, ki temeljijo na spremljanju v različnih časovnih
obdobjih, je treba zagotoviti, da se obseg in kontekst sistema vodenja informacijske varnosti ne
spremenita,
b) spremembe metod ali tehnik, ki se uporabljajo za merjenje in spremljanje, na splošno ne
zagotavljajo primerljivih rezultatov. Za ohranitev primerljivosti se lahko zahtevajo posebni testi,
kot je vzporedna uporaba prvotnih in spremenjenih metod,

c) če so subjektivni elementi del metod ali tehnik, ki se uporabljajo za merjenje in spremljanje, bodo
za pridobitev ponovljivih rezultatov morda potrebni posebni koraki. Rezultati vprašalnika naj bodo
na primer ovrednoteni na podlagi opredeljenih kriterijev; in

d) v nekaterih primerih je mogoče ponovljivost zagotoviti le v specifičnih okoliščinah. Včasih
rezultatov na primer ni mogoče ponoviti, vendar so veljavni, če so združeni.

5.4 Koristi
Izpolnjevanje procesov in kontrol sistema vodenja informacijske varnosti ter zagotavljanje delovanja
informacijske varnosti lahko zagotovi številne organizacijske in finančne koristi. Glavne koristi so
lahko:
a) Povečana odgovornost: spremljanje, merjenje, analiza in vrednotenje lahko povečajo
odgovornost za informacijsko varnost, saj so v pomoč pri prepoznavanju specifičnih procesov ali
kontrol informacijske varnosti, ki se izvajajo nepravilno, se ne izvajajo ali so neučinkoviti.

b) Izboljšanje delovanja informacijske varnosti in procesov sistema vodenja informacijske
varnosti: spremljanje, merjenje, analiza in vrednotenje lahko organizacijam omogočijo, da
količinsko opredelijo izboljšave pri varovanju informacij v obsegu svojega sistema vodenja
informacijske varnosti in izkažejo merljiv napredek pri doseganju ciljev organizacije na področju
informacijske varnosti.
c) Dokaz o izpolnjevanju zahtev: spremljanje, merjenje, analiza in vrednotenje lahko zagotovijo
dokumentirane dokaze, ki so v pomoč pri izkazovanju izpolnjevanja zahtev standarda
ISO/IEC 27001 (in drugih standardov) ter veljavnih zakonov, pravil in predpisov.

SIST ISO/IEC 27004 : 2018
d) Podpora pri odločanju: spremljanje, merjenje, analiza in vrednotenje lahko podpirajo odločanje
na podlagi informacij o tveganjih, saj v proces obvladovanja tveganja prispevajo merljive
informacije. Organizacije lahko tako merijo uspešnost oziroma neuspešnost preteklih in trenutnih
naložb v informacijsko varnost ter pridobijo merljive podatke, ki lahko podpirajo dodeljevanje virov
za prihodnje naložbe.
6 Lastnosti
6.1 Splošno
Spremljanje in merjenje sta prvi korak v procesu vrednotenja delovanja informacijske varnosti in
uspešnosti sistema vodenja informacijske varnosti.

Ob potencialno velikem številu atributov subjektov, povezanih z informacijsko varnostjo, ki jih je
mogoče meriti, ni povsem jasno, katere naj se meri. To je pomembno vprašanje, saj merjenje
prevelikega števila lastnosti ali napačnih lastnosti ni praktično oziroma je drago in kontraproduktivno.
Poleg očitnih stroškov merjenja, analiziranja in sporočanja številnih atributov obstaja jasna možnost,
da se v veliki količini informacij zameglijo ključna vprašanja ali pa se ta v celoti spregledajo, če niso
določena ustrezna merila.
Za določitev, kaj spremljati in meriti, naj organizacija najprej razmisli, kaj želi doseči pri vrednotenju
delovanja informacijske varnosti in uspešnosti sistema vodenja informacijske varnosti. Tako lahko
določi svoje potrebe po informacijah.

Organizacije naj se nato odločijo, katera merila so potrebna za podporo posamezne diskretne potrebe
po informacijah in kateri podatki so potrebni za izpeljavo zahtevanih meril. Zato naj merjenje vedno
ustreza potrebam po informacijah organizacije.

6.2 Kaj spremljati
Spremljanje določa stanje sistema, procesa ali aktivnosti za izpolnjevanje specifične potrebe po
informacijah.
Sistemi, procesi in aktivnosti, ki jih je mogoče spremljati, med drugim vključujejo, vendar niso omejeni
na:
a) izvajanje procesov sistema vodenja informacijske varnosti,

b) vodenje incidentov,
c) upravljanje ranljivosti,
d) upravljanje konfiguracije,
e) ozaveščenost in usposabljanje o varnosti,

f) nadzor dostopa, požarni zid in drugo beleženje dogodkov

g) presojo,
h) proces ocenjevanja tveganj,

i) proces obravnavanja tveganj,

j) obvladovanje tveganja tretjih strani,

k) vodenje neprekinjenega poslovanja,

l) upravljanje fizične in okoljske varnosti; ter

m) spremljanje sistema.
Te aktivnosti spremljanja zagotavljajo podatke (dnevnike dogodkov, razgovore z uporabniki, statistiko

SIST ISO/IEC 27004 : 2018
usposabljanja, informacije o incidentih itd.), ki se lahko uporabijo za podporo drugim merilom. V
procesu določanja atributov, ki jih je treba meriti, se lahko zahteva dodatno spremljanje, da se
zagotovijo podporne informacije.

S spremljanjem lahko organizacija ugotovi, ali se je tveganje uresničilo, in tako določi ukrepe, ki jih
lahko sprejme za obravnavanje takega tveganja. Upošteva naj se tudi, da so lahko nekatere vrste
kontrol informacijske varnosti izrecno namenjene spremljanju. Pri uporabi rezultatov takih kontrol za
podporo merjenju naj organizacije zagotovijo, da proces merjenja upošteva, ali so bili uporabljeni
podatki pridobljeni pred ali po izvedenem ukrepu obravnavanja.

6.3 Kaj meriti
Merjenje je aktivnost, ki se izvaja za določitev vrednosti, stanja ali trenda delovanja ali uspešnosti, da
se lažje opredelijo morebitne potrebe po izboljšavah. Merjenje se lahko uporablja za vse procese,
aktivnosti, kontrole in skupine kontrol sistema vodenja informacijske varnosti.

Kot primer se lahko navede točka 7.2 c) v ISO/IEC 27001:2013, ki od organizacije zahteva, da po
potrebi sprejme ukrepe za pridobitev potrebne usposobljenosti. Organizacija lahko ugotovi, ali so bili
vsi posamezniki, ki so potrebovali usposabljanje, tega deležni in ali je bilo usposabljanje izvedeno, kot
je bilo načrtovano. To je mogoče izmeriti s številom ali odstotkom usposobljenih oseb. Organizacija
lahko tudi ugotovi, ali so posamezniki, ki so se usposabljali, dejansko pridobili in ohranili potrebne
usposobljenosti (kar je mogoče izmeriti z vprašalnikom po usposabljanju).

V zvezi s procesi sistema vodenja informacijske varnosti naj organizacije upoštevajo, da standard
ISO/IEC 27001 vsebuje več točk, ki izrecno zahtevajo, da se določi uspešnost nekaterih aktivnosti.
Točka 10.1 d) v ISO/IEC 27001:2013 na primer zahteva, da organizacije "pregledajo uspešnost vseh
izvedenih korektivnih ukrepov". Za izvedbo takega pregleda naj se najprej določi uspešnost
korektivnih ukrepov v smislu neke opredeljene oblike merila. V ta namen naj organizacija najprej
opredeli ustrezno potrebo po informacijah in merilo ali merila za njeno izpolnitev. Postopek za to je
pojasnjen v točki 8.
Procesi in aktivnosti sistema vodenja informacijske varnosti, ki so primerni za merjenje, vključujejo:

a) načrtovanje,
b) voditeljstvo,
c) obvladovanje tveganj,
d) vodenje politike,
e) upravljanje virov,
f) sporočanje,
g) vodstveni pregled,
h) dokumentiranje; in
i) presojo.
Kar zadeva delovanje informacijske varnosti, so najbolj očitni kandidati kontrole informacijske varnosti
organizacije ali skupine takih kontrol (ali celo celoten načrt obravnavanja tveganj). Te kontrole so
določene znotraj procesa obravnavanja tveganja in so v standardu ISO/IEC 27001 navedene kot
potrebne kontrole. To so lahko kontrole iz standarda ISO/IEC 27001:2013 (dodatek A), področne
kontrole (npr. opredeljene v standardih, kot je ISO/IEC 27010), kontrole, določene v drugih standardih,
in kontrole, ki jih je zasnovala organizacija. Ker je namen kontrole spreminjanje tveganja, je mogoče
meriti različne atribute, kot so:

j) stopnja, do katere kontrola zmanjšuje verjetnost nastanka dogodka,

k) stopnja, do katere kontrola zmanjšuje posledice dogodka,

SIST ISO/IEC 27004 : 2018
l) pogostost dogodkov, ki jo kontrola lahko obvladuje pred odpovedjo; in

m) v kolikšnem času po nastopu dogodka kontrola zazna, da je dogodek nastopil.

6.4 Kdaj spremljati, meriti, analizirati in vrednotiti

Organizacije naj opredelijo posebne časovne okvire za spremljanje, merjenje, analizo in vrednotenje
na podlagi posameznih potreb po informacijah, zahtevanih meril in življenjskega cikla podatkov, ki
podpirajo posamezna merila. Zbiranje podatkov, ki podpirajo merila, se lahko izvaja pogosteje kot
analiza in sporočanje teh meril posameznim zainteresiranim stranem. Podatke o varnostnih incidentih
je na primer mogoče zbirati neprekinjeno, poročanje o teh podatkih zunanjim zainteresiranim stranem
pa naj temelji na posebnih zahtevah, kot so resnost (po možnosti zahteva po takojšnjem obvestilu kot
v primeru kršitve, o kateri je treba poročati) ali zbirne vrednosti (kot v primeru poskusov vdorov, ki so
bili odkriti in blokirani).
Organizacije naj upoštevajo, da je treba za izpolnitev nekaterih potreb po informacijah pred začetkom
analize in vrednotenja zbrati ustrezno količino podatkov, da se zagotovi smiselna podlaga za
ocenjevanje in primerjavo (npr. pri izvajanju statistične analize). Poleg tega je treba postopke
spremljanja, merjenja, analize in vrednotenja testirati ter prilagoditi, preden so pridobljena merila
uporabna za organizacijo. Organizacije naj zato določijo omejitev trajanja morebitnega natančnega
prilagajanja (da lahko nadaljujejo s končnim ciljem, merjenjem sistema vodenja informacijske varnosti)
in kako dolgo naj se izvajata spremljanje in zbiranje, preden se lahko začneta analiza in vrednotenje.

Organizacije lahko ob posodobitvi svojih aktivnosti merjenja prilagodijo svoje časovne okvire merjenja
tako, da upoštevajo posebne spremembe v okolju, navedene v 8.2. Če na primer organizacija prehaja
z ročnega vira podatkov na avtomatizirani vir, bo morda potrebna sprememba pogostosti zbiranja.
Poleg tega je potrebno izhodišče za primerjavo dveh naborov meril, uporabljenih v različnih časovnih
obdobjih in morebiti z različnimi metodami, vendar za namene izpolnjevanja iste potrebe po
informacijah.
Organizacija lahko svoje dejavnosti spremljanja, merjenja, analize in vrednotenja strukturira v program
merjenja, vendar pa je pomembno vedeti, da ISO/IEC 27001 od organizacij ne zahteva, da imajo
vzpostavljen tak program.
6.5 Kdo bo spremljal, meril, analiziral in vrednotil

Organizacije (ob upoštevanju zahtev točk 9.1 in 5.3 v ISO/IEC 27001:2013) naj določijo, kdo spremlja,
meri, analizira in vrednoti v smislu posameznikov ali vlog. Spremljanje, merjenje, analizo in
vrednotenje je mogoče izvajati z ročnimi ali avtomatiziranimi sredstvi. Ne glede na to, ali se merjenje
izvaja ročno ali samodejno, lahko organizacije opredelijo naslednje vloge in odgovornosti, povezane z
merjenjem:
a) naročnik merjenja: vodstvo ali druge zainteresirane strani, ki zahtevajo informacije o uspešnosti
sistema vodenja informacijske varnosti, kontrol ali skupine kontrol,

b) načrtovalec merjenja: oseba ali organizacijska enota, ki opredeli merilne konstrukcije, ki
povezujejo merljive atribute z določeno potrebo po informacijah,

c) recenzent merjenja: oseba ali organizacijska enota, ki potrdi, da so oblikovani konstrukti merjenja
primerni za vrednotenje delovanja informacijske varnosti in uspešnosti sistema vodenja
informacijske varnosti, kontrol ali skupine kontrol,

d) lastnik informacij: oseba ali organizacijska enota, ki je lastnik informacij, ki zagotavljajo vhodne
podatke za merila. Ta oseba je odgovorna za zagotavljanje podatkov in je pogosto (vendar ne
vedno) odgovorna tudi za izvajanje aktivnosti merjenja,

e) zbiralec informacij: oseba ali organizacijska enota, odgovorna za zbiranje, evidentiranje in
shranjevanje podatkov,
f) informacijski analitik: oseba ali organizacijska enota, odgovorna za analizo podatkov; in

SIST ISO/IEC 27004 : 2018
g) sporočevalec informacij: oseba ali organizacijska enota, odgovorna za posredovanje rezultatov
analize.
Organizacije lahko nekatere ali celo vse te vloge združijo.

Posamezniki, ki med procesi opravljajo različne vloge in odgovornosti, bodo morda potrebovali
različna znanja in spretnosti ter s tem povezano ozaveščenost in usposabljanje.

7 Vrste meril
7.1 Splošno
Za namene teh smernic je mogoče delovanje načrtovanih aktivnosti in uspešnost rezultatov izmeriti z
uporabo naslednjih dveh vrst meril:

a) merila učinkovitosti delovanja: merila, ki odražajo načrtovane rezultate v smislu značilnosti
načrtovane aktivnosti, kot so število zaposlenih, doseganje mejnikov ali stopnja izvajanja kontrol
informacijske varnosti,
b) merila uspešnosti: merila, ki odražajo učinek, ki ga ima uresničevanje načrtovanih aktivnosti na
cilje informacijske varnosti organizacije.

Ta merila so lahko specifična za posamezno organizacijo, saj ima vsaka organizacija svoje posebne
cilje, politike in zahteve glede informacijske varnosti.

Izraza "merila učinkovitosti delovanja" in "merila uspešnosti" naj se ne zamenjata z zahtevo točke 9.1
v ISO/IEC 27001:2013 za vrednotenje delovanja informacijske varnosti in uspešnosti sistema vodenja
informacijske varnosti.
7.2 Merila učinkovitosti delovanja

Merila učinkovitosti delovanja je mogoče uporabiti za prikaz napredka pri izvajanju procesov sistema
vodenja informacijske varnosti, povezanih postopkov in posebnih varnostnih kontrol. Medtem ko se
uspešnost navezuje na obseg, v katerem so bile izvedene načrtovane aktivnosti in doseženi
načrtovani rezultati, naj se merila učinkovitosti delovanja navezujejo na obseg, v katerem so bili
izvedeni procesi in kontrole informacijske varnosti. Ta merila so v pomoč pri ugotavljanju, ali so bili
procesi sistema vodenja informacijske varnosti in kontrole informacijske varnosti izvedeni, kot je
določeno.
Merila učinkovitosti delovanja uporabljajo podatke, ki jih je mogoče pridobiti iz zapisnikov, evidenc
prisotnosti, projektnih načrtov, samodejnih orodij za optično branje ter drugih pogosto uporabljenih
sredstev za dokumentiranje, beleženje in spremljanje dejavnosti sistema vodenja informacijske
varnosti.
Zbiranje, analiza in sporočanje meril naj bodo avtomatizirani, če je to mogoče, da se zmanjšajo
potrebni stroški in delo ter možnost človeških napak.

SIST ISO/IEC 27004 : 2018
Primer 1
Pri merjenju stopnje izvajanja specifičnih kontrol informacijske varnosti, kot je odstotek prenosnih
računalnikov s šifriranjem trdega diska, bodo rezultati tega merila sprva verjetno nižji od 100 %. Ko
rezultat doseže 100 % in tam ostane, je mogoče sklepati, da so informacijski sistemi v celoti izvedli
varnostne kontrole, ki jih obravnava to merilo, aktivnosti merjenja pa je mogoče osredotočiti na druge
kontrole, ki jih je treba izboljšati.
Primer 2
Pri novem sistemu vodenja informacijske varnosti naj si organizacija najprej prizadeva, da se najvišje
vodstvo udeleži pregleda in drugih sestankov, ki jih je mogoče sklicati. Načrtovani (ali predvideni)
rezultat v tem primeru je popolna udeležba na vseh sestankih, razen v primeru bolezni in dovoljenih
predhodnih obveznosti. Merilo preprosto izraža razmerje med številom udeležencev in številom tistih,
ki bi se morali udeležiti, z morebitnim dejavnikom sprememb, da je bila odsotnost upravičena. Sprva bi
rezultati teh meril lahko kazali na primanjkljaj, vendar bi morali sčasoma doseči načrtovane cilje in
ostati blizu njih. Na tej točki naj organizacija svoja prizadevanja za merjenje osredotoči na merila
uspešnosti (glej 7.3).
Ko večina meril učinkovitosti delovanja doseže 100 % in tam ostane, naj organizacija svoja
prizadevanja za merjenje osredotoči na merila uspešnosti. Organizacije naj nikoli ne opustijo meril
učinkovitosti delovanja v celoti, saj so lahko koristna pri opozarjanju na določene varnostne kontrole, ki
jih je treba izboljšati. Sčasoma naj se poudarek in viri, ki se uporabljajo za merjenje, s teh meril
preusmerijo na merila uspešnosti (glej 7.3).

V skladu z 9.1 v ISO/IEC 27001:2013 je prav tako pomembno, da se meri tudi uspešnost sistema
vodenja (obravnavano v nadaljevanju). Za delovanje ustreznega sistema vodenja informacijske
varnosti naj organizacije v načrtovanih časovnih intervalih merijo delovanje in uspešnost.

7.3 Merila uspešnosti
Merila uspešnosti naj bodo uporabljena za opis uspešnosti in vpliva, ki ga ima uresničevanje načrta
obravnavanja tveganj sistema vodenja informacijske varnosti ter procesov in kontrol sistema vodenja
informacijske varnosti na cilje informacijske varnosti organizacije. S temi merili naj se ugotovi, ali
procesi sistema vodenja informacijske varnosti in kontrole informacijske varnosti delujejo, kot je bilo
predvideno, in dosegajo želene rezultate. Glede na te cilje je mogoče merila uspešnosti uporabiti za
količinsko opredelitev, npr.:
a) prihrankov, ki jih zagotovi sistem vodenja informacijske varnosti, ali stroškov, nastalih zaradi
obravnavanja informacijskih varnostnih incidentov,

b) stopnje zaupanja strank, ki jo je pridobil ali ohranil sistem vodenja informacijske varnosti; in

c) doseganja drugih ciljev informacijske varnosti.

Merila uspešnosti je mogoče oblikovati z združevanjem podatkov, pridobljenih iz avtomatiziranih orodij
za spremljanje in vrednotenje, in ročno pridobljenih podatkov o aktivnostih sistema vodenja
informacijske varnosti. To lahko zahteva sledenje različnim merilom v organizaciji na način, ki ga je
mogoče neposredno povezati z aktivnostmi sistema vodenja informacijske varnosti in informacijskimi
varnostnimi dogodki. Za doseganje tega naj ima organizacija vzpostavljene zmogljivosti za:

d) ovrednotenje stopnje uvedbe procesov, kontrol ali skupin kontrol sistema vodenja informacijske
varnosti na podlagi meril učinkovitosti delovanja,

e) zbiranje podatkov avtomatiziranih orodij za spremljanje in vrednotenje,

f) ročno zbiranje podatkov iz aktivnosti sistema vodenja informacijske varnosti,

g) normaliziranje in analiziranje podatkov iz več avtomatiziranih in ročnih virov; ter

h) razlago in sporočanje teh podatkov odločevalcem.

SIST ISO/IEC 27004 : 2018
Ta merila uspešnosti združujejo informacije o uresničevanju načrta obravnavanja tveganj z različnimi
informacijami o virih in lahko prispevajo k procesu obvladovanja tveganja. Prav tako lahko zagotovijo
najbolj neposreden vpogled v vrednost informacijske varnosti za organizacijo in so lahko tisti, ki bi
morali biti najbolj zanimivi za najvišje vodstvo.

Primer 3
Izkoriščanje znanih ranljivosti je poznano kot vzrok za velik del informacijskih varnostnih incidentov.
Večje kot je število znanih ranljivosti in dlje kot se ne odpravijo (npr. popravijo), večja je verjetnost, da
jih bodo izkoristile povezane grožnje, in večja je izpostavljenost s tem povezanemu tveganju. Merilo
uspešnosti je lahko organizaciji v pomoč pri ugotavljanju njene izpostavljenosti tveganjem zaradi
takšnih ranljivosti.
Primer 4
Tečaj usposabljanja ima lahko za vsak modul določene cilje usposabljanja. Na podlagi merila
uspešnosti lahko organizacija ugotovi, v kolikšni meri je posamezen udeleženec usposabljanja
razumel posamezno lekcijo in je sposoben uporabiti svoje novo znanje in spretnosti. Ta merila
običajno zahtevajo več podatkovnih točk, kot so: rezultati testov po usposabljanju, pregled podatkov o
incidentih, povezanih s temami usposabljanja, ali analiza klicev oddelka za pomoč uporabnikom,
povezanih s temami usposabljanja.

8 Procesi
8.1 Splošno
Spremljanje, merjenje, analiza in vrednotenje (glej sliko 2) so sestavljeni iz naslednjih procesov:

a) prepoznavanje potreb po informacijah,

b) ustvarjanje in vzdrževanje meril,

c) vzpostavitev postopkov,
d) spremljanje in merjenje,
e) analiza rezultatov; in
f) vrednotenje delovanja informacijske varnosti in uspešnosti sistema vodenja informacijske
varnosti.
Poleg tega obstaja proces upravljanja sistema vodenja informacijske varnosti, ki zajema pregled in
izboljševanje zgornjih postopkov (glej 8.8).

SIST ISO/IEC 27004 : 2018
Prepoznavanje potreb po
informacijah
Vrednotenje delovanja
Ustvarjanje in vzdrževanje
informacijske varnosti in
meril
uspešnosti sistema vodenja
informacijske varnosti
Analiza rezultatov Vzpostavitev postopkov
Spremljanje in merjenje
Slika 2: Procesi spremljanja, merjenja, analize in vrednotenja

8.2 Prepoznavanje potreb po informacijah

Oblikovanje meril naj se začne s prepoznavanjem potreb po informacijah, ki so lahko v pomoč pri
razumevanju operativnih značilnosti in/ali delovanja kateregakoli vidika sistema vodenja informacijske
varnosti, na primer kateregakoli od naslednjih:

a) potrebe zainteresirane strani,

b) strateška usmeritev organizacije,

c) informacijska varnostna politika in cilji informacijske varnosti; ter

d) načrt obravnavanja tveganj.

Za prepoznavanje ustreznih potreb po informacijah naj se izvedejo naslednje aktivnosti:

e) preverjanje sistema vodenja informacijske varnosti, njegovih procesov in drugih elementov, kot
so:
1) informacijska varnostna politika in cilji informacijske varnosti, cilji kontrol in kontrole,

2) pravne, regulativne, pogodbene in organizacijske zahteve za informacijsko varnost; ter

3) rezultati procesa obvladovanja tveganj informacijske varnosti;

f) prednostna razvrstitev prepoznanih potreb po informacijah na podlagi kriterijev, kot so:

1) prednostne naloge obravnavanja tveganja,

2) zmožnosti in viri organizacije,

SIST ISO/IEC 27004 : 2018
3) potrebe zainteresirane strani,

4) informacijska varnostna politika in cilji informacijske varnosti ter cilji kontrol,

5) informacije, potrebne za izpolnjevanje organizacijskih, zakonskih, regulativnih in pogodbenih
obveznosti; ter
6) vrednost informacij, ki jo je treba pridobiti, glede na stroške merjenja;

g) izbira podizbora potreb po informacijah, ki jih je treba obravnavati pri aktivnostih merjenja, s
prednostnega seznama; in
h) dokumentiranje in sporočanje izbranih potreb po informacijah vsem ustreznim zainteresiranim
stranem.
8.3 Ustvarjanje in vzdrževanje meril

8.3.1 Splošno
Organizacije naj merila oblikujejo enkrat, nato pa naj jih pregledujejo in sistematično posodabljajo v
načrtovanih časovnih intervalih ali ko se okolje sistema vodenja informacijske varnosti bistveno
spremeni. Take spremembe lahko med drugim vključujejo:

a) obseg sistema vodenja informacijske varnosti,

b) organizacijsko strukturo,
c) zainteresirane strani, vključno z vlogami, odgovornostmi in pooblastili zainteresiranih strani,

d) poslovne cilje in zahteve,
e) zakonske in regulativne zahteve,

f) doseganje želenih in stabilnih rezultatov v več zaporednih ciklih; ter

g) uvod ali razpolaganje s tehnologijami in sistemi za obdelavo informacij.

Ustvarjanje ali posodabljanje takih meril lahko med drugim vključuje naslednje korake:

h) opredelitev trenutnih varnostnih praks, ki lahko podpirajo potrebe po informacijah,

i) oblikovanje ali posodabljanje meril,

j) dokumentiranje meril in opredelitev prednostne naloge izvajanja; ter

k) obveščanje in vključevanje vodstva.

Pričakuje se, da bo posodabljanje meril zahtevalo manj časa in dela kot začetno ustvarjanje.

8.3.2 Opredelitev trenutnih varnostnih praks, ki lahko podpirajo potrebe po informacijah

Ko je potreba po informacijah prepoznana, naj organizacije popišejo obstoječe prakse merjenja in
varnosti kot morebitno komponento merjenja. Obstoječe prakse merjenja in varnosti lahko vključujejo
meritve, povezane s/z:
a) obvladovanjem tveganj,
b) vodenjem projektov,
c) poročanjem o skladnosti; in

d) varnostnimi politikami.
SIST ISO/IEC 27004 : 2018
8.3.3 Oblikovanje ali posodabljanje meril

Merila naj ustrezajo potrebam po informacijah. Lahko temeljijo na aktualnih praksah ali pa zahtevajo
nove. Na novo opredeljena merila lahko vključujejo tudi prilagoditev obstoječih meril ali procesov
merjenja. V vsakem primeru naj bodo merila opredeljena dovolj podrobno, da se lahko uporabijo.

Primeri podatkov, ki se lahko zbirajo v podporo varnostnim merilom, vključujejo:

a) izhodne podatke različnih dnevnikov in snemanj,

b) statistične podatke o usposabljanju in drugih aktivnostih na področju človeških virov,

c) ustrezne ankete in vprašalnike,

d) statistične podatke o incidentih,

e) rezultate notranjih presoj,

f) rezultate vaj za neprekinjeno poslovanje/obnovitev po katastrofi; in

g) poročila z vodstvenih pregledov.

Ti in drugi potencialni viri podatkov, ki so lahko notranjega ali zunanjega izvora, naj bodo preučeni in
opredeljene naj bodo vrste razpoložljivih podatkov.

Izbrana merila naj podpirajo prednostne potrebe po informacijah in lahko vključujejo:

h) lažje zbiranje podatkov,
i) razpoložljivost človeških virov za zbiranje in upravljanje podatkov,

j) razpoložljivost ustreznih orodij,

k) število potencialno ustreznih kazalnikov uspešnosti, ki jih podpira merilo,

l) lažjo razlago,
m) število uporabnikov pridobljenih rezultatov merjenj,

n) dokaze o ustreznosti merila glede na namen ali potrebo po informacijah; in

o) stroške zbiranja, upravljanja in analiziranja podatkov.

Organizacije naj vsako merilo dokumentirajo v obliki, ki merilo povezuje z ustrezno potrebo (ali
potrebami) po informacijah in zagotavlja zadostne informacije o značilnostih, ki opisujejo merilo, ter o
tem, kako ga zbirati, analizirati in sporočati. Predlagani deskriptorji informacij so navedeni v
preglednici 1.
Primeri v dodatku B uporabljajo preglednico 1 kot predlogo. Dva primera imata dodatni deskriptor
informacij (imenovan "ukrep"), ki opredeljuje ukrep, ki ga je treba sprejet
...