Information security objectives and planning to achieve them

Plain-language summary

Setting measurable information security objectives at the right levels, consistent with the policy and informed by the risk work, with a plan for each — what, who, when, which resources and how you will know it worked — then monitoring and updating them.

What the clause is really asking

Objectives make the policy's promises specific. The clause asks for objectives at relevant functions and levels that are consistent with the policy, measurable where practicable, take account of applicable requirements and of the results of risk assessment and treatment, are monitored (added in 2022), communicated, updated as appropriate, and available as documented information. For each objective you plan what will be done, what resources it needs, who is responsible, when it will be complete and how the results will be evaluated. Good objectives sound like 'reduce the median time to apply critical patches from 21 to 7 days by June' or 'all privileged accounts on hardware-token MFA by Q3', not 'improve security awareness'. If you run ISO 9001, this is clause 6.2 again, and the same objectives register will carry both sets.

What auditors look for

Auditors ask for the objectives and check each one against the clause: measurable, linked to the policy, linked to a risk or requirement, with a plan, an owner and a date. Then they ask for the latest measurement and where it was reviewed — monitoring is now explicit, so an objective that was set a year ago and never measured is a finding. They look for objectives at more than one level (IT, HR, operations) and for communication: does the person responsible for an objective know it exists? They also check objectives were updated when a risk closed or a new one appeared.

Typical evidence

Information security objectives register with measures, targets, owners, dates and resources; evidence of monitoring (dashboards, KPI reports, management-review minutes); link from each objective to the policy commitment and to the risk or requirement it addresses; evidence of communication to the responsible functions; records of updates.

How to comply — recommendations

Set five to eight objectives for the year, each derived from a top risk, a requirement or a policy commitment, with a numeric measure and a quarter-end target. Give each an owner outside the ISMS team where possible so the business owns security outcomes. Track them on one page that is a standing item at management review, and show the trend, not just the current value. When an objective is met, retire it and set the next one; when a risk changes, change the objective. Share the page with the people who own the work — it doubles as the communication the clause requires.

Common nonconformities

Objectives vague and not measurable; not linked to policy, risks or requirements; no plan (resources, owner, date, evaluation method); objectives set but never monitored or measured; not communicated to the people responsible; no objectives at function level, only one corporate statement; not documented.

Resources for this clause

• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.