ISO/IEC 27004:2009, Information technology - Security techniques - Information security management - Measurement

✍ Scribed by ISO/IEC/JTC 1/SC 27

• Publisher: Multiple. Distributed through American National Standards Institute (ANSI)
• Year: 2009
• Tongue: English
• Leaves: 64
• Category: Library

✦ Synopsis

ISO/IEC 27004:2009 provides guidance on the development and use of measures and measurement in order to assess the effectiveness of an implemented information security management system (ISMS) and controls or groups of controls, as specified in ISO/IEC 27001.ISO/IEC 27004:2009 is applicable to all types and sizes of organization.

✦ Table of Contents

Management overview......Page 6
Terms and definitions......Page 9
Structure of this International Standard......Page 11
Objectives of information security measurement......Page 12
Information Security Measurement Programme......Page 13
Overview......Page 14
Base measure and measurement method......Page 15
Derived measure and measurement function......Page 17
Indicators and analytical model......Page 18
Measurement results and decision criteria......Page 19
Overview......Page 20
Definition of measurement scope......Page 21
Object and attribute selection......Page 22
Measurement method......Page 23
Decision criteria......Page 24
Data collection, analysis and reporting......Page 25
Procedure integration......Page 26
Analyse data and develop measurement results......Page 27
Overview......Page 28
Implement improvements......Page 29