The international standard ISO/IEC 27004 is part of the ISO 27000 series of standards. In 2009 it was published by Joint Technical Committee JTC1 established by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). Its official title is "Information technology — Security techniques — Information security management — Measurement".

ISO 27001 requires an Information Security Management System (ISMS) and its controls to be reviewed regularly for their effectiveness so that the necessary level of security is ensured. By complying with ISO 27004 you meet these requirements: ISO 27004 helps organisations develop measurement systems to assess the effectiveness of an ISMS as well as individual controls as defined in ISO 27001. Since ISO 27004 is to be used in conjunction with ISO 27001, certification is not possible.