1、BS ISO/IEC 27004:2016Information technology Security techniques Information securitymanagement Monitoring,measurement, analysis andevaluationBSI Standards PublicationWB11885_BSI_StandardCovs_2013_AW.indd 1 15/05/2013 15:06BS ISO/IEC 27004:2016 BRITISH STANDARDNational forewordThis British Standard i
2、s the UK implementation of ISO/IEC 27004:2016. It supersedes BS ISO/IEC 27004:2009 which is withdrawn.The UK participation in its preparation was entrusted to Technical Committee IST/33/1, Information Security Management.A list of organizations represented on this committee can be obtained on reques
3、t to its secretary.This publication does not purport to include all the necessary provisions of a contract. Users are responsible for its correct application. The British Standards Institution 2016.Published by BSI Standards Limited 2016ISBN 978 0 580 83513 1 ICS 35.030 Compliance with a British Sta
4、ndard cannot confer immunity from legal obligations.This British Standard was published under the authority of the Standards Policy and Strategy Committee on 31 December 2016.Amendments/corrigenda issued since publicationDate T e x t a f f e c t e dBS ISO/IEC 27004:2016Information technology Securit
5、y techniques Information security management Monitoring, measurement, analysis and evaluationTechnologies de linformation Techniques de scurit Management de la scurit de linformation Surveillance, mesurage, analyse et valuationINTERNATIONAL STANDARDISO/IEC27004Reference numberISO/IEC 27004:2016(E)Se
6、cond edition2016-12-15 ISO/IEC 2016BS ISO/IEC 27004:2016ii ISO/IEC 2016 All rights reservedCOPYRIGHT PROTECTED DOCUMENT ISO/IEC 2016, Published in SwitzerlandAll rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form or by any mea
7、ns, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below or ISOs member body in the country of the requester.ISO copyright officeCh. de Blandonnet 8 CP 401CH-121
8、4 Vernier, Geneva, SwitzerlandTel. +41 22 749 01 11Fax +41 22 749 09 47copyrightiso.orgwww.iso.orgISO/IEC 27004:2016(E)BS ISO/IEC 27004:2016ISO/IEC 27004:2016(E)Foreword ivIntroduction v1 Scope . 12 Normative references 13 Terms and definitions . 14 Structure and overview . 15 Rationale . 25.1 The n
9、eed for measurement 25.2 Fulfilling the ISO/IEC 27001 requirements . 35.3 Validity of results 35.4 Benefits 36 Characteristics 46.1 General . 46.2 What to monitor. 46.3 What to measure . 56.4 When to monitor, measure, analyse and evaluate 66.5 Who will monitor, measure, analyse and evaluate . 67 Typ
10、es of measures 77.1 General . 77.2 Performance measures 77.3 Effectiveness measures 88 Processes 98.1 General . 98.2 Identify information needs 108.3 Create and maintain measures . 118.3.1 General. 118.3.2 Identify current security practices that can support information needs .118.3.3 Develop or upd
11、ate measures 128.3.4 Document measures and prioritize for implementation .138.3.5 Keep management informed and engaged .138.4 Establish procedures 148.5 Monitor and measure . 148.6 Analyse results . 158.7 Evaluate information security performance and ISMS effectiveness .158.8 Review and improve moni
12、toring, measurement, analysis and evaluation processes 158.9 Retain and communicate documented information 15Annex A (informative) An information security measurement model 17Annex B (informative) Measurement construct examples .19Annex C (informative) An example of free-text form measurement constr
13、uction 57Bibliography .58 ISO/IEC 2016 All rights reserved iiiContents PageBS ISO/IEC 27004:2016ISO/IEC 27004:2016(E)ForewordISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission) form the specialized system for worldwide standardization. Nat
14、ional bodies that are members of ISO or IEC participate in the development of International Standards through technical committees established by the respective organization to deal with particular fields of technical activity. ISO and IEC technical committees collaborate in fields of mutual interes
15、t. Other international organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the work. In the field of information technology, ISO and IEC have established a joint technical committee, ISO/IEC JTC 1.The procedures used to develop this document and those int
16、ended for its further maintenance are described in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for the different types of document should be noted. This document was drafted in accordance with the editorial rules of the ISO/IEC Directives, Part 2 (see www.iso
17、.org/directives).Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent rights. Details of any patent rights identified during the development of the docume
18、nt will be in the Introduction and/or on the ISO list of patent declarations received (see www.iso.org/patents).Any trade name used in this document is information given for the convenience of users and does not constitute an endorsement.For an explanation on the meaning of ISO specific terms and ex
19、pressions related to conformity assessment, as well as information about ISOs adherence to the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT) see the following URL: www.iso.org/iso/foreword.html.The committee responsible for this document is ISO/IEC JTC 1, Informa
20、tion technology, Subcommittee SC 27, IT Security techniques.This second edition of ISO/IEC 27004 cancels and replaces the first edition (ISO/IEC 27004:2009), which has been technically revised.This edition includes the following significant changes with respect to the previous edition: A total restr
21、ucturing of the document because it has a new purpose to provide guidance on ISO/IEC 27001:2013, 9.1 which, at the time of the previous edition, did not exist. The concepts and processes have been modified and expanded. However, the theoretical foundation (ISO/IEC 15939) remains the same and several
22、 of the examples given in the previous edition are preserved, albeit updated.iv ISO/IEC 2016 All rights reservedBS ISO/IEC 27004:2016ISO/IEC 27004:2016(E)IntroductionThis document is intended to assist organizations to evaluate the information security performance and the effectiveness of an informa
23、tion security management system in order to fulfil the requirements of ISO/IEC 27001:2013, 9.1: monitoring, measurement, analysis and evaluation.The results of monitoring and measurement of an information security management system (ISMS) can be supportive of decisions relating to ISMS governance, m
24、anagement, operational effectiveness and continual improvement.As with other ISO/IEC 27000 documents, this document should be considered, interpreted and adapted to suit each organizations specific situation. The concepts and approaches are intended to be broadly applicable but the particular measur
25、es that any particular organization requires depend on contextual factors (such as its size, sector, maturity, information security risks, compliance obligations and management style) that vary widely in practice.This document is recommended for organizations implementing an ISMS that meets the requ
26、irements of ISO/IEC 27001. However, it does not establish any new requirements for ISMS which conform to ISO/IEC 27001 or impose any obligations upon organizations to observe the guidelines presented. ISO/IEC 2016 All rights reserved vBS ISO/IEC 27004:2016BS ISO/IEC 27004:2016Information technology
27、Security techniques Information security management Monitoring, measurement, analysis and evaluation1 ScopeThis document provides guidelines intended to assist organizations in evaluating the information security performance and the effectiveness of an information security management system in order
28、 to fulfil the requirements of ISO/IEC 27001:2013, 9.1. It establishes:a) the monitoring and measurement of information security performance;b) the monitoring and measurement of the effectiveness of an information security management system (ISMS) including its processes and controls;c) the analysis
29、 and evaluation of the results of monitoring and measurement.This document is applicable to all types and sizes of organizations.2 Normative referencesThe following documents are referred to in the text in such a way that some or all of their content constitutes requirements of this document. For da
30、ted references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies.There are no normative references in this document.3 Terms and definitionsFor the purposes of this document, the terms and definitions given in ISO
31、/IEC 27000 apply.ISO and IEC maintain terminological databases for use in standardization at the following addresses: IEC Electropedia: available at http:/www.electropedia.org/ ISO Online browsing platform: available at http:/www.iso.org/obp4 Structure and overviewThis document is structured as foll
32、ows:a) Rationale (Clause 5);b) Characteristics (Clause 6);c) Types of measures (Clause 7);d) Processes (Clause 8).The ordering of these clauses is intended to aid understanding and map to ISO/IEC 27001:2013, 9.1 requirements, as is illustrated in Figure 1.Starting with the information needed to fulf
33、il that requirement, referred to as information needs, the organization determines the measures that it will use to fulfil those information needs. The process INTERNATIONAL STANDARD ISO/IEC 27004:2016(E) ISO/IEC 2016 All rights reserved 1BS ISO/IEC 27004:2016ISO/IEC 27004:2016(E)of monitoring and m
34、easurement produces data which is then analysed. The results of analysis are evaluated in fulfilment of the organizations information needs.In addition, Annex A describes a measurement model for information security, including the relationship between the components of the measurement model and the
35、requirements of ISO/IEC 27001:2013, 9.1.Annex B provides a wide range of examples. These examples are intended to provide practical guidance on how organizations can monitor, measure, analyse and evaluate their chosen ISMS processes and areas of information security performance. These examples use t
36、he suggested template given in Table 1. Annex C provides a further example using an alternative free-form text-based format.Figure 1 Mapping to ISO/IEC 27001:2013, 9.1 requirements5 Rationale5.1 The need for measurementThe overall objective of an ISMS is the preservation of confidentiality, integrit
37、y and availability of information within its scope. There are ISMS activities that concern the planning of how to do this, and the implementation of those plans. However, by themselves, these activities cannot guarantee that the realisation of those plans fulfil the information security objectives.
38、Therefore, in the ISMS as defined by ISO/IEC 27001, there are several requirements to evaluate if the plans and activities ensure the fulfilment of the information security objectives.2 ISO/IEC 2016 All rights reservedBS ISO/IEC 27004:2016ISO/IEC 27004:2016(E)5.2 Fulfilling the ISO/IEC 27001 require
39、mentsISO/IEC 27001:2013, 9.1 requires the organization to evaluate the information security performance and the effectiveness of the ISMS. Measure types able to fulfil these requirements can be found in Clause 7.ISO/IEC 27001:2013, 9.1 further requires the organization to determine:a) what needs to
40、be monitored and measured, including information security processes and controls;b) the methods for monitoring, measurement, analysis and evaluation, as applicable, to ensure valid results;c) when the monitoring and measuring shall be performed;d) who shall monitor and measure;e) when the results fr
41、om monitoring and measurement shall be analysed and evaluated; andf) who shall analyse and evaluate these results.The mapping of these requirements is provided in Figure 1.Finally, ISO/IEC 27001:2013, 9.1 requires the organization to retain appropriate documented information as evidence of the monit
42、oring and measurement results (See 8.9).ISO/IEC 27001:2013, 9.1 also notes that methods selected should produce comparable and reproducible results in order for them to be considered valid (See 6.4).5.3 Validity of resultsISO/IEC 27001:2013, 9.1 b) requires that organizations choose methods for meas
43、urement, monitoring, analysis and evaluation to ensure valid results. The clause notes that to be valid, results should be comparable and reproducible. To achieve this, organizations should collect, analyse, and report measures, taking the following points into consideration:a) in order to get compa
44、rable results on measures that are based on monitoring at different points in times, it is important to ensure that scope and context of the ISMS are not changed;b) changes in the methods or techniques used for measuring and monitoring do not generally lead to comparable results. In order to retain
45、comparability, specific tests such as parallel application of the original as well as the changed methods can be required;c) if subjective elements are part of the methods or techniques used for measuring and monitoring, specific steps can be needed to obtain reproducible results. As an example, que
46、stionnaire results should be evaluated against defined criteria; andd) in some situations, reproducibility can only be given in specific circumstances. For example, there are situations where results are non-reproducible, but are valid when aggregated.5.4 BenefitsFulfilling ISMS processes and contro
47、ls and ensuring information security performance can provide a number of organizational and financial benefits. Major benefits can include:a) Increased accountability: Monitoring, measurement, analysis and evaluation can increase accountability for information security by helping to identify specifi
48、c information security processes or controls that are implemented incorrectly, are not implemented, or are ineffective.b) Improved information security performance and ISMS processes: Monitoring, measurement, analysis and evaluation can enable organizations to quantify improvements in securing infor
49、mation ISO/IEC 2016 All rights reserved 3BS ISO/IEC 27004:2016ISO/IEC 27004:2016(E)within the scope of their ISMS and demonstrate quantifiable progress in accomplishing the organizations information security objectives.c) Evidence of meeting requirements: Monitoring, measurement, analysis and evaluation can provide documented evidence that helps demonstrate fulfilling of ISO/IEC 27001 (and other standards) requirements, as well as applicable laws, rules, and regulations.d) Support decision-making: Monitoring, measurem
