ISO/IEC 27004 describes techniques for: • Monitoring and measuring of information security performance. • Monitoring and measuring the effectiveness of an
Information Security Management System (ISMS), including the management processes and controls. • Analysis and evaluation of the results of monitoring and measurement. The techniques are intended to apply to all types of organization, regardless of shape and size. Although virtually any observable characteristic or activity can potentially be measured, the process of measuring and using the information consumes corporate resources. This therefore begs questions about which aspects of an ISMS are or are not worth measuring. Furthermore, there are numerous measurement techniques, whether quantitative (objective, fact based), qualitative (subjective, opinion based) or some blend of the two. Questions such as what to measure, how and when to measure it, who should gather, analyse and report the information, how to present the measurement data and analysis are for management to determine. Generally speaking, senior/executive managers and directors are most concerned about the achievement of strategic business objectives. They tend to value broad, high-level, long-range measurements and trends relating to the management of information risks and security arrangements, plus governance aspects, in support of strategic business objectives. Middle and lower levels of management typically value more detailed contemporaneous information necessary to direct and control activities appropriately, again within the overall business context and objectives. At all levels, measurements help determine: • Whether changes are needed at all e.g. to improve the effectiveness or efficiency of security operations, or to maintain current levels. • Priorities for any necessary changes, relative to other aspects, activities, concerns etc. • The nature and extent of changes, including the evaluation and comparison of alternative approaches. • Whether activities, processes, systems, changes etc. are in fact achieving the intended results, at the appropriate rate (feedback). • Whether progress can be demonstrated, credibly, to various stakeholders. == Terms and structure ==