0.1  General

 0.1 总则

This International Standard provides guidance on the development and use of measures and measurement in order to assess the effectiveness of an implemented information security management system (ISMS) and controls or groups of controls, as specified in ISO/IEC 27001.

本国际标准为通过开发和使用量测、度量评估实施ISMS和ISO27001中的控制的效果提供指导。

This would include policy, information security risk management, control objectives, controls, processes and procedures, and support the process of its revision, helping to determine whether any of the ISMS processes or controls need to be changed or improved. It needs to be kept in mind that no measurement of controls can guarantee complete security.

 这将包括策略，信息安全风险管理，控制目标，控制，流程和步骤和支持流程改进，帮助决定是否ISMS流程或控制需要变更或改进。一点必须要记住“没有对控制的量测能保证完全安全”。

The implementation of this approach constitutes an Information Security Measurement Programme. The Information Security Measurement Programme will assist management in identifying and evaluating non-compliant and ineffective ISMS processes and controls and prioritizing actions associated with improvement or changing these processes and/or controls. It may also assist the organization in demonstrating ISO/IEC 27001 compliance and provide additional evidence for management review and information security risk management processes.

 这个方法的实施构建一个信息安全度量计划，ISMP将评估在识别和评估不符合和无效的ISMS过程和控制并且将

区分处理与改进或改变这些过程和/或控制。这也将帮助组织在演示ISO27001的符合并且为管理层复审和信息安全管理过程提供附加的证据。

This International Standard assumes that the starting point for the development of measures and

measurement is a sound understanding of the information security risks that an organization faces, and that an organization’s risk assessment activities have been performed correctly (i.e. based on ISO/IEC 27005), as required by ISO/IEC 27001. The Information Security Measurement Programme will encourage an organization to provide reliable information to relevant stakeholders concerning its information security risks and the status of the implemented ISMS to manage these risks.

 本国际标准假设开发量测和度量的起点是理解组织所面临的信息安全风险并且ISO27001需要的组织的风险评估活动已经正确的完成（基于ISO27005）。ISMP将激励组织向有关的股东就他（指代组织）的信息安全风险和实施ISMS的状态提供可靠的信息来管理这些风险。

Effectively implemented, the Information Security Measurement Programme would improve stakeholder confidence in measurement results, and enable the stakeholders to use these measures to effect continual improvement of information security and the ISMS.

有效的实施，ISMP将改善股东在度量结果上的信心并且使股东使用这些量测机制来影响信息安全和ISMS的持续改进。

The accumulated measurement results will allow comparison of progress in achieving information security objectives over a period of time as part of an organization’s ISMS continual improvement process.

积累的度量结果将允许对在一段时间上达成信息安全目标的改进做比较，这将作为组织ISMS持续改进过程的一部分。