Overview
ISO/IEC TS 33072:2016 - Process capability assessment model for information security management - defines a Process Assessment Model (PAM) tailored to Information Security Management. The Technical Specification provides assessment indicators and examples that support conformant process-capability assessments in line with ISO/IEC 33004 and the process measurement framework of ISO/IEC 33020. It aligns process purposes and outcomes from ISO/IEC TS 33052 with capability attributes and offers guidance on defining, selecting and using assessment indicators.
Key topics
- Process Assessment Model (PAM): A structured model that expands a Process Reference Model (PRM) for information security with measurable indicators.
- Two-dimension structure:
- Process dimension - describes process purposes, outcomes and base practices (process performance indicators).
- Capability dimension - adopts capability levels and process attributes from ISO/IEC 33020.
- Assessment indicators:
- Process performance indicators (base practices) for Level 1 and related process outcomes.
- Process capability indicators including generic practices, resource indicators and input/output characteristics for capability evaluation.
- Capability scale (Levels 0–5):
- Level 0: Incomplete process
- Level 1: Performed process
- Level 2–5: Managed, Established, Predictable, Innovating
- Inputs/outputs guidance: Annex B provides typical input/output characteristics to help assessors evaluate capability.
- Conformance & mappings: Annex A states PAM conformance to ISO/IEC 33004; Annex C maps base practices to ISO/IEC 27001 requirements.
Practical applications
- Process capability assessment: Use ISO/IEC TS 33072 to perform consistent, repeatable assessments of information security processes.
- Self-assessment and benchmarking: Organizations can benchmark ISMS process capability internally or against peers when assessment scopes are comparable.
- Process improvement programs: Identify gaps, prioritize improvements and track capability progression using the defined indicators and capability levels.
- Audit and supplier evaluation: Support evidence-based supplier selection, third‑party assessment and audit preparation.
- Tool and method selection: Evaluate or design assessment tools/methodologies for information security process measurement that conform to ISO/IEC 33004.
Who should use it
- ISMS managers and security teams
- Process assessors and auditors
- Compliance and risk officers
- Consultants and service providers offering assessments or improvement programs
- Tool developers for process-assessment and governance platforms
Related standards
- ISO/IEC 33002 - Requirements for performing process assessment
- ISO/IEC 33004 - Requirements for process assessment models
- ISO/IEC 33020 - Process measurement framework (capability levels)
- ISO/IEC TS 33052 - Process reference model for information security
- ISO/IEC 27001 - Information Security Management System requirements
Keywords: ISO/IEC TS 33072:2016, process assessment model, PAM, information security management, process capability, assessment indicators, ISO/IEC 33020, ISO/IEC 33004, ISO/IEC TS 33052.