Measures

Last checked on 29-09-2026

Measures is where you describe what your organisation actually does to protect itself, such as daily backups or multi-factor sign-in. You link each measure to risks, requirements and evidence, and see at once whether it still works.

Why this protects your organisation

A measure that exists on paper but that nobody carries out any more protects nothing. Recording who carries out each measure, which risks it reduces and which evidence shows it works lets you spot early when something has slipped. For ISO 27001 this is the heart of clause 6.1.3 and the controls in Annex A: you choose measures based on your risks and can show that they work.

Steps

Open Measures in the Measures and evidence group and click the button to create a new measure.
Fill in Name and How it works. Write it so a new colleague would understand it.
Choose the Type, the Status, an Owner and a Review date, then save.
On the measure's page, use Link risk to connect the risks it reduces.
Use Link requirement to connect the requirements of your standards that it covers, and choose the Coverage.
Use Link evidence to connect the evidence that shows the measure works.
Once the measure is in place, click Approve in the list. That makes it active.

Still working?

Trustbird gives every measure a signal that it works out for itself:

In order: the measure is active, its review date has not passed and at least one active piece of evidence is linked that is still valid.
Needs attention: the measure is active, but its review is overdue or there is no valid evidence.
Not active: the measure has a status other than Active, such as Draft or No longer in use.

The measure's page shows the signal at the top with a one sentence explanation. In the list you can filter by Status, Type and Still working?.

Type

The Type helps you see where your protection lies. Organisational is about agreements and roles, technical about systems, procedural about fixed steps people follow, and physical about buildings and equipment. Older measures may show Not yet classified. If so, pick a type.

AI assessment of the evidence

When evidence is linked to a measure that covers a requirement, the AI reads that evidence and gives an opinion per requirement, with a short explanation and a certainty score. That opinion is a suggestion. It changes nothing about the status you set or the signal, not even when you click Agree with this opinion. If the AI is not certain enough, it gives no opinion and the owner gets a task to look at it themselves. Assess evidence again starts a fresh assessment.

If it does not work

I cannot choose Active as a status

A measure only becomes active through Approve in the list. That way there is a record of who approved it and when.

The list under Link requirement is empty

You can only link requirements of standards your workspace has adopted. Adopt a standard first under Standards in the Prove group.

My measure is active but shows Needs attention

Either the review date has passed, or no evidence is linked that is active and still valid. Link current evidence or bring the review date up to date, for example by completing a review.

I do not see Approve or Link risk

Those are available to the workspace owner and members. An advisor needs edit rights on the Risks and controls module.

Screens this is about

Measures