ISO/IEC 27004:2016提供了旨在帮助组织评估信息安全性能和信息安全管理系统有效性的指南，以满足ISO/IEC 27001:2013，9.1的要求。它规定: a） 信息安全性能的监视和测量； b） 监控和测量信息安全管理系统（ISMS）的有效性，包括其流程和控制； c） 对监视和测量结果的分析和评估。 ISO/IEC 27004:2016适用于所有类型和规模的组织。

ISO/IEC 27004:2016 provides guidelines intended to assist organizations in evaluating the information security performance and the effectiveness of an information security management system in order to fulfil the requirements of ISO/IEC 27001:2013, 9.1. It establishes: a) the monitoring and measurement of information security performance; b) the monitoring and measurement of the effectiveness of an information security management system (ISMS) including its processes and controls; c) the analysis and evaluation of the results of monitoring and measurement. ISO/IEC 27004:2016 is applicable to all types and sizes of organizations.