Key takeaways
- Set measurable security objectives and plan who does what, by when, with what resources, and how results are evaluated.
- Objectives turn policy into measurable goals and show whether security is improving.
- Start here: set objectives consistent with the policy and measurable where practical.
Purpose
Set measurable security objectives and plan who does what, by when, with what resources, and how results are evaluated.
Requirement
Requirement summaryThe organization shall establish information security objectives at relevant functions and levels. The information security objectives shall: a) be consistent with the information security policy; b) be measurable (if practicable); c) take into account applicable information security requirements, and results from risk assessment and risk treatment; d) be monitored; e) be communicated; f) be updated as appropriate; g) be available as documented information. The organization shall retain documented information on the information security objectives. When planning how to achieve its information security objectives, the organization shall determine: h) what will be done; i) what resources will be required; j) who will be responsible; k) when it will be completed; and l) how the results will be evaluated.
Why it matters
Objectives turn policy into measurable goals and show whether security is improving.
How to implement
- Set objectives consistent with the policy and measurable where practical.
- Plan what will be done, resources, responsibility, timelines and evaluation.
- Communicate objectives.
- Monitor and update them.
What evidence you need to provide
Here is what you will typically need to provide for Clause 6.2. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your security objectives: measurable goals with an owner, deadline and resources.
Records and examples to show
- Progress reports against each objective.
- Proof objectives were shared with the relevant people.
Things you should be able to show or explain
- Owners should be able to explain progress and next steps.
How much to show: All objectives.
Common mistakes
- Goals that can't be measured.
- No one tracking progress.
- Vague objectives like 'improve security'.
- No plan for achieving them.
- Tip: Your Statement of Applicability is the document auditors ask about most. Make it tidy!
Policies & documents to have
- Information security objectives plan
FAQ
Can we exclude clause 6.2?
No. Clauses 4–10 are mandatory for certification; only Annex A controls can be excluded, with justification.
What do auditors look for?
SMART objectives with plans and progress tracking.