Key Facts
- Regulator
- ISO/IEC JTC 1/SC 27 (published by ISO and IEC)
- Latest version
- ISO/IEC 27004:2016 (Edition 2), Information technology — Security techniques — Information security management — Monitoring, measurement, analysis and evaluation; revision under way (ISO/IEC DIS 27004, Edition 3)
- Effective
- 15 December 2016
- Official text
- www.iso.org ↗
What is ISO 27004?
ISO 27004, formally ISO/IEC 27004, is the international guidance standard for measuring how well an information security management system performs. ISO and IEC publish it, and ISO/IEC JTC 1/SC 27 developed it. It applies to organisations of every type and size and is written to help meet clause 9.1 of ISO/IEC 27001.
The current edition is ISO/IEC 27004:2016 (Edition 2), Information technology — Security techniques — Information security management — Monitoring, measurement, analysis and evaluation, published in December 2016. ISO's standard page describes it as guidelines, not requirements. It replaced the 2009 edition and was updated and extended to align with the revised ISO/IEC 27001.
A revision is under way. ISO/IEC 27004:2016 is at stage 90.92 (to be revised). Its replacement, ISO/IEC DIS 27004 (Edition 3), is retitled under "Information security, cybersecurity and privacy protection". It is at the enquiry stage: voting on the draft closed on 16 September 2026 (stage 40.60). Until it publishes, the 2016 edition is the one to cite.
Why it matters
The auditor asks how you know your ISMS is working. You have policies, a risk register and a quiet incident log, but nothing that shows whether any of it is performing.
ISO/IEC 27001 expects you to evaluate information security performance and ISMS effectiveness. ISO/IEC 27004 is the guidance written to help you do that. Among the benefits ISO names:
- greater accountability for security;
- better security performance and better ISMS processes;
- evidence of meeting ISO/IEC 27001 and applicable laws, rules and regulations.
A metric nobody acts on is a number, not a control.
The risk is rarely a lack of data. It is a set of figures that nobody can tie back to a security objective, so the evaluation exists on paper only and says nothing to management.
Who it applies to
ISO/IEC 27004 applies to all types and sizes of organisation. In practice its reader is whoever owns an ISO/IEC 27001 ISMS: the security lead or compliance manager who has to show that clause 9.1 is met. Because the scope is not limited by size or sector, a firm outside ISO 27001 can use it too.
The obligation is light. ISO/IEC 27004 is guidance only: ISO describes it as guidelines to assist organisations, and it is not a certifiable requirements standard. Treat it as voluntary. Nobody certifies you against it, although clause 9.1 itself is a requirement of ISO/IEC 27001.
That is the relationship to ISO 27001. ISO/IEC 27001 says you must evaluate performance; ISO/IEC 27004 explains how to build the measurement behind that evaluation, including how to report the results of a set of security metrics. For the requirement itself, see clause 9.1 Monitoring, measurement, analysis and evaluation in the ISO 27001 vault.
The UK position
No UK law or regulator names ISO/IEC 27004. A UK firm meets it through ISO/IEC 27001, usually while preparing for a certification audit that will test clause 9.1. Outside an ISO 27001 programme, a UK firm rarely meets it.
Key requirements
Because ISO/IEC 27004 is guidance, what follows is structure rather than a list of duties. The standard establishes three things:
- Monitoring and measurement of information security performance.
- Monitoring and measurement of ISMS effectiveness, including its processes and controls.
- Analysis and evaluation of the results of that monitoring and measurement.
In plain terms, performance asks whether your security activity is producing the results you intended. Effectiveness asks whether the ISMS, with its processes and controls, achieves what it was built to do. Analysis and evaluation turn the figures into a judgement that management can act on.
The measurement programme
ISO describes the standard as showing how to:
- build an information security measurement programme;
- select what to measure;
- run the measurement processes it needs.
It also explains how to assess and report the results, and it carries extensive examples of measures.
Choosing what to measure is the real decision. Collecting the data is the easy part.
Frequently asked questions
ISO/IEC 27001 sets the requirements for an information security management system, including clause 9.1 on evaluating performance. ISO/IEC 27004 is guidance that explains how to meet that clause: how to build a measurement programme, choose what to measure and report the results.
No. ISO/IEC 27004 is a guidelines standard, not a certifiable requirements standard, so there is no certificate to hold. Its value is indirect: following ISO/IEC 27004 gives you measurement evidence to show an ISO/IEC 27001 auditor that clause 9.1 is being met in practice.
ISO/IEC 27004:2016 (Edition 2), published in December 2016, is the current edition, and it is marked to be revised. A replacement, ISO/IEC DIS 27004 (Edition 3), closed its draft ballot on 16 September 2026. Until ISO publishes it, the 2016 edition is the one to cite.
Yes. ISO says ISO/IEC 27004:2016 is applicable to all types and sizes of organisation. Selecting what to measure is part of the guidance, so a small firm can start with a handful of measures tied to its security objectives rather than building a large metrics set.
Yes. ISO/IEC 27004:2016 was written to help meet clause 9.1 of ISO/IEC 27001:2013, and ISO/IEC 27001:2022 keeps clause 9.1 under the same title: monitoring, measurement, analysis and evaluation. The guidance still fits, although ISO/IEC 27004 refers to the 2013 edition until Edition 3 publishes.