Information technology — Security techniques — Information security management — Monitoring, measurement, analysis and evaluation Technologies de l’information — Techniques de sécurité — Management de la sécurité de l’information — Surveillance, mesurage, analyse et évaluationINTERNATIONAL STANDARDISO/IEC27004 Reference numberISO/IEC 27004:2016(E)Second edition2016-12-15 © ISO/IEC 2016 Este documento forma parte de la biblioteca de la UNIVERSIDAD INTERNACIONAL DE LA RIOJA ii © ISO/IEC 2016 – All rights reservedCOPYRIGHT PROTECTED DOCUMENT © ISO/IEC 2016, Published in SwitzerlandAll rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below or ISO’s member body in the country of the requester.ISO copyright officeCh. de Blandonnet 8 • CP 401CH-1214 Vernier, Geneva, SwitzerlandTel. +41 22 749 01 11Fax +41 22 749 09 47copyright@iso.orgwww.iso.org ISO/IEC 27004:2016(E) Este documento forma parte de la biblioteca de la UNIVERSIDAD INTERNACIONAL DE LA RIOJA ISO/IEC 27004:2016(E) Foreword ........................................................................................................................................................................................................................................ iv Introduction .................................................................................................................................................................................................................................. v 1 Scope ................................................................................................................................................................................................................................. 1 2 Normati ve references ...................................................................................................................................................................................... 1 3 Terms and definitions ..................................................................................................................................................................................... 1 4 Structur e and overview ................................................................................................................................................................................. 1 5 Rationale ....................................................................................................................................................................................................................... 2 5.1 The need f or measurement .......................................................................................................................................................... 2 5.2 F ulfilling the ISO/IEC 27001 requirements ......... .......................................................................................................... 3 5.3 V alidity of results .................................................................................................................................................................................. 3 5.4 Benefits .......................................................................................................................................................................................................... 3 6 Characteristics ........................................................................................................................................................................................................ 4 6.1 Gener al ...............................................................................................................................