ISO 27001 clause 6.2: Security objectives and achievement plans
ISO 27001 clause 6.2 requires information security objectives at relevant functions and levels, together with planning for their achievement. Useful objectives describe results that matter to the organisation. “Buy a security tool” is an activity; improving a defined security outcome is a more useful basis for management oversight.
What clause 6.2 requires in practice
Clause 6.2 asks the organisation to set objectives for information security within the functions and levels where they apply. Seven qualities are listed. Objectives must be consistent with the policy, measurable where practicable and take into account applicable requirements and the results of risk assessment and treatment. They must also be monitored, communicated, updated as appropriate and available as documented information. Documented information on the objectives must be retained.
The clause also requires planning. When deciding how to achieve objectives, the organisation determines what will be done, what resources are needed, who is responsible, when it will be finished and how results will be evaluated.
The expression measurable where practicable leaves room for qualitative objectives when numbers do not fit. The outputs are a set of objectives and plans that managers actually use to steer security work.
Choose objectives that follow policy and risk
Objectives should be consistent with policy and take account of applicable requirements and assessment and treatment results. Avoid selecting metrics only because a dashboard already displays them. A large number of blocked events may say little about the controls protecting the organisation’s most important information or its ability to recover a service.
Objectives are measurable where practicable, monitored, communicated, updated as appropriate and available as documented information. A qualitative objective is not a reason to abandon evaluation. Define what an informed assessment would consider, who can make it and what evidence would support the conclusion.
Plan how the result will be achieved
For each objective, establish the work, resources, responsible owner, completion expectations and approach to evaluating results. Consider dependencies on suppliers, business teams and technology changes. The standard does not impose identical targets or deadlines on every organisation; those choices should reflect its needs and commitments.
Distinguish the target from its measure and implementation actions. For example, a recovery-readiness objective can use representative restoration exercises as evidence. The action plan might address missing procedures, access to recovery data and staff competence. Purchasing backup capacity alone does not establish that the objective has been achieved.
Where a percentage is used, define the population and exclusions. “All critical assets reviewed” is unreliable if the critical-asset list is incomplete or continually adjusted to remove difficult cases. Documented definitions help successive reports remain comparable.
Why objectives matter to the business
Objectives turn a policy from intent into direction. Without them, security teams measure activity, such as the volume of alerts closed, instead of the outcomes leaders care about, such as protecting a key service or recovering from disruption. Well-chosen objectives help executives decide where to invest, give each function a concrete contribution and provide evidence for management review that the system is improving. They also keep the ISMS connected to risk, since the strongest objectives respond to what assessment and treatment found. For customers, objectives show the organisation is working toward something specific rather than simply maintaining a certificate.
How to implement clause 6.2
Start from priorities and keep the set small enough to manage. One approach Sterling teams use is to draw candidate objectives directly from the risk treatment plan. Fewer, better objectives are easier to monitor than a long list that nobody reviews.
- Review the policy commitments, risk results and applicable requirements, and list outcomes that matter most.
- Write each objective as a result, not an activity, adding a measure where it genuinely helps.
- Allocate objectives to the functions and levels able to influence them.
- For each, record what will be done, resources, owner, completion point and method of evaluation.
- Communicate the objectives and the reasons for them to the people involved.
- Monitor progress at regular reviews, updating or retiring objectives as circumstances change.
- Link each objective to a named risk, requirement or policy commitment, so that when priorities shift you can see which objectives still matter and which can be retired without weakening the overall direction.
Illustrative examples
The business identifies an important hosted service and the recovery needs agreed with its customer. It plans an exercise that includes data restoration and validation by the service owner. Results reveal that restoration is possible but the team cannot promptly access a necessary dependency. The objective review leads to a specific action rather than a misleading green status based on backup-job success.
The organisation wants accountable approval and review of privileged access on systems supporting production information. It defines the relevant accounts, assigns reviewers and tracks unresolved exceptions. The objective focuses on effective decision coverage, not simply how many review forms were sent.
Evidence that supports evaluation
Keep the objectives as documented information and retain the relevant records. Plans, reports, review decisions and changes to actions can show how achievement was managed. Evidence should allow a reviewer to distinguish a missed target, a poorly designed measure and a change in business need.
Clause 9.1 supports measurement and evaluation, while management review considers fulfilment of objectives. An objective can be useful even when it is not yet achieved if the result is accurately understood and management acts appropriately. Rewriting the target retrospectively to hide a shortfall undermines the evidence.
Common mistakes
Avoid objectives with no owner, measures detached from business risk or plans dependent on resources that have never been approved. A fixed annual review alone may be too slow for an objective linked to a major service launch. Equally, daily reporting adds little when the underlying outcome cannot meaningfully change that quickly.
Review whether objectives still fit the organisation after a change in scope, service or risk. A small set of well-defined priorities with reliable evidence is generally easier to manage than a long catalogue of measures nobody uses.
Frequently asked questions
Must every objective be numerical?
Objectives should be measurable where practicable. Where a qualitative assessment is appropriate, make the intended result and evaluation basis clear enough for a defensible judgement.
Is implementing a security product a suitable objective?
It is usually an implementation action. Define the security result the product is intended to support and how you will evaluate whether that result has been achieved.
Does missing a target automatically mean certification failure?
A missed target needs evaluation in context. Examine the planning, monitoring, response and applicable requirements rather than assuming every shortfall has the same conformity implication.
Choose security objectives that support the business
Talk to Sterling to turn broad ambitions into relevant objectives with accountable owners, resources, measurement and a credible evaluation plan. Build the relevant knowledge through KPIs, Objectives & Management Review at Sterling Academy. We can also assess whether Effivity ISO & GRC automation software suits the agreed workflow and programme. Certification decisions remain with an independent certification body.