ISO 27001 information security objectives (clause 6.2) with example
Information security objectives are specific goals that show what you want to achieve with your ISMS, and how you measure it. ISO 27001 requires this in clause 6.2: set objectives for the relevant functions and levels, keep them consistent with the policy, and monitor them. A goal such as “we are secure” does not meet this. A goal such as “95 percent of employees complete the awareness training before 1 December” does. They follow from the risk assessment and belong to the ISMS. The policy that the objectives come from is on the information security policy page.
What does clause 6.2 require?
Clause 6.2 contains a number of requirements that together form the core of the objectives. The essentials:
- Consistent with the policy. Each objective must align with the information security policy.
- Measurable, where practical. The standard says “if practicable”. If you cannot measure an objective, decide how you will otherwise assess progress.
- Take requirements into account. Objectives consider applicable requirements and the outcome of the risk assessment.
- Monitor, communicate and update. You track progress, share the objectives with those they affect, and change them when needed.
- Plan. For each objective, you record what you will do, which resources you need, who is responsible, when it must be done and how you will assess the result.
- Document. You keep documented information as evidence.
The exact wording of clause 6.2 is in the standard itself. Use this list as an overview, and check the text in your own copy of the standard before you cite it as a source in a document.
Well-written and poorly written objectives
The difference lies in measurability. An objective you cannot check is only a wish.
| Poor | Why | Better |
|---|---|---|
| We become safer | Not measurable, no end point | The number of open critical vulnerabilities is zero by 31 December |
| Employees are aware | No standard, no measurement | 95 percent of employees have completed the awareness training |
| We handle incidents well | No target value | Each incident is closed within 5 working days with an evaluation |
| The ISMS is up to date | No way to check | The ISMS documents have been reviewed at least once in the past six months |
Example: objectives for “Example Ltd”
A small software company with twelve people, fictional. Each objective lists the measurement and the owner.
| Objective | Measurement | Target | Review point | Owner |
|---|---|---|---|---|
| All employees have completed the awareness training | Percentage of completed training from the LMS | 95 percent | 1 December 2026 | HR manager |
| Critical vulnerabilities are patched quickly | Average lead time for critical patches | Maximum 14 days | Monthly | System administrator |
| Access rights are revoked on time | Number of departed employees with active access after leaving | Zero | Monthly | IT management |
| Incidents are handled on time | Percentage of incidents closed within 5 working days | 90 percent | Every quarter | Security officer |
| Suppliers with access are assessed | Percentage of assessed suppliers | 100 percent | Yearly | Purchasing |
There are five. More is not better. It is better to have five objectives you meet than twenty that nobody tracks. Many objectives link to the controls in Annex A, for example vulnerability management and incident management.
How do you plan one objective?
Choose the objective and the measurement
One objective, one measurement, one target value. If you cannot measure it, reword it.
Decide the actions
What will you concretely do to reach the objective? Write down no more than three actions.
Name the resources and the owner
Which budget and time do you need, and who is responsible? One owner per objective, otherwise nobody owns it.
Set a review point
When do you check whether it works? Monthly, quarterly or yearly. Put it in the diary.
Record it and communicate
Add it to the objectives overview and share it with the people it affects. Keep the evidence of the measurement.
Link to the risk assessment
Objectives do not appear out of nowhere. The risk assessment shows where the biggest risks are, and you base your priorities on that. If the risk of “unauthorised access to customer data” scores high, an objective on access rights makes sense. If no objective covers a high risk, the auditor will ask why.
What does the auditor ask?
The auditor asks to see your objectives overview and the measurement results from the recent period. They want to see that you monitor progress, that you take corrective action when an objective is not met and that management is informed. The management review uses the level of achievement as an input. An objective that has been red for two years without action can be raised by the auditor as a nonconformity.
Common mistakes
- Objectives that repeat the policy. “We protect information” is a policy statement, not an objective.
- No measurement. Without a measurement, you cannot show whether you met the objective.
- Too many objectives. A list of twenty objectives is never kept up to date.
- No owner. An objective that “the team” must meet is met by nobody.
- Objectives that never change. If all objectives have stayed the same for three years, the ISMS has probably not kept pace with the organisation.
Frequently asked questions
Do I need objectives for every control in Annex A? No. Objectives focus on what matters for your organisation, not on all 93 controls. See Annex A for the controls you do select.
How often should I adjust them? Reviewing them yearly is common, and also after every major change or serious incident. The standard requires you to update them where needed.
Is an objective that I do not meet a problem? Not necessarily. A missed objective with an analysis and a new plan is better than an objective you quietly drop. Record the cause and decide what you will do.