CAN/CSA-ISO/IEC 27004:18

Foreword
Introduction
1 Scope
2 Normative references
3 Terms and definitions
4 Structure and overview
5 Rationale
6 Characteristics
7 Types of measures
8 Processes
Annex A (informative) - An information security
        measurement model
Annex B (informative) - Measurement construct
        examples
Annex C (informative) - An example of free-text
        form measurement construction
Bibliography

Preface Standards development within the Information Technology sector is harmonized with international standards development. Through the CSA Technical Committee on Information Technology (TCIT), Canadians serve as the SCC Mirror Committee (SMC) on ISO/IEC Joint Technical Committee 1 on Information Technology (ISO/IEC JTC1) for the Standards Council of Canada (SCC), the ISO member body for Canada and sponsor of the Canadian National Committee of the IEC. Also, as a member of the International Telecommunication Union (ITU), Canada participates in the International Telegraph and Telephone Consultative Committee (ITU-T). For brevity, this Standard will be referred to as \"CAN/CSA-ISO/IEC 27004\" throughout. This Standard supersedes CAN/CSA-ISO/IEC 27004:10 (adopted ISO/IEC 27004:2009). Scope This document provides guidelines intended to assist organizations in evaluating the information security performance and the effectiveness of an information security management system in order to fulfil the requirements of ISO/IEC 27001:2013, 9.1. It establishes: a) the monitoring and measurement of information security performance; b) the monitoring and measurement of the effectiveness of an information security management system (ISMS) including its processes and controls; c) the analysis and evaluation of the results of monitoring and measurement. This document is applicable to all types and sizes of organizations.

Preface Standards development within the Information Technology sector is harmonized with international standards development. Through the CSA Technical Committee on Information Technology (TCIT), Canadians serve as the SCC Mirror Committee (SMC) on ISO/IEC Joint Technical Committee 1 on Information Technology (ISO/IEC JTC1) for the Standards Council of Canada (SCC), the ISO member body for Canada and sponsor of the Canadian National Committee of the IEC. Also, as a member of the International Telecommunication Union (ITU), Canada participates in the International Telegraph and Telephone Consultative Committee (ITU-T). For brevity, this Standard will be referred to as \"CAN/CSA-ISO/IEC 27004\" throughout. This Standard supersedes CAN/CSA-ISO/IEC 27004:10 (adopted ISO/IEC 27004:2009). Scope This document provides guidelines intended to assist organizations in evaluating the information security performance and the effectiveness of an information security management system in order to fulfil the requirements of ISO/IEC 27001:2013, 9.1. It establishes: a) the monitoring and measurement of information security performance; b) the monitoring and measurement of the effectiveness of an information security management system (ISMS) including its processes and controls; c) the analysis and evaluation of the results of monitoring and measurement. This document is applicable to all types and sizes of organizations.