Information security objectives and planning to achieve them
Plain English Translation
Clause 6.2 requires the organization to move beyond high-level intentions and set specific, measurable goals for information security. These objectives must be consistent with the Information Security Policy and relevant risk assessment results. The organization must not only define 'what' the goals are (e.g., reduce incidents by 10%, achieve 100% staff training) but also create a concrete plan detailing resources, responsibilities, and deadlines to achieve them.
Technical Implementation
Use the tabs below to select your organization size.
Required Actions (startup)
- Define 3-5 high-level objectives (e.g., 'Pass ISO 27001 audit', 'Implement MFA for all users')
- Track progress in a simple shared document or spreadsheet
- Review status quarterly with the CTO
Required Actions (scaleup)
- Establish departmental security objectives (e.g., Engineering: 'Fix critical vulns within 48h')
- Link objectives to individual performance goals where appropriate
- Report on metrics monthly to the security steering committee
Required Actions (enterprise)
- Integrate automated metric tracking into GRC dashboards
- Utilize balanced scorecards for security performance measurement
- Align security objectives directly with corporate risk appetite statements
Clause 6.2 mandates that organizations establish specific, measurable goals to track the performance and effectiveness of their Information Security Management System (ISMS).
Use the SMART framework: Specific, Measurable, Achievable, Relevant, and Time-bound. For example, 'Reduce the average time to patch critical vulnerabilities to 48 hours by Q4.'
Examples include: 'Achieve 100% completion of security awareness training', 'Maintain 99.9% system availability', 'Reduce critical vulnerabilities by 20%', or 'Obtain ISO 27001 certification by year-end'.
Review the high-level commitments in your Information Security Policy (Clause 5.2) and ensure every objective supports those commitments (e.g., if policy says 'comply with laws', an objective could be 'zero regulatory fines').
Measurable means you can track it with data. SMART is a broader framework ensuring the objective is also specific, achievable, relevant to the business, and has a deadline.
For each objective, determine: what will be done (actions), what resources are needed (budget/tools), who is responsible (owner), when it will be completed (deadline), and how results will be evaluated. In practice, it helps to keep these plans auditable by linking actions to owners, metrics, and evidence; for example, WatchDog Security's Compliance Center can associate objectives with control activities and the artifacts you'll show during audits.
The three core objectives are Confidentiality, Integrity, and Availability (the CIA triad). ISO 27001 requires you to set specific performance goals to support these core concepts.
Progress is measured by collecting data (metrics) related to the objective—such as logs, ticket closure rates, or audit scores—and comparing them against the target value defined in your plan. Where metrics come from multiple systems, centralizing them with a clear audit trail reduces gaps; for example, WatchDog Security's Compliance Center can track objective status, related evidence, and management review notes over time.
Security objectives often fail when they live in a slide deck with no owner, cadence, or evidence trail, making it hard to prove monitoring and updates during an audit. A GRC platform helps by assigning owners, linking objectives to controls and evidence, and maintaining an auditable history of targets, status, and review notes. For example, WatchDog Security's Compliance Center can track objectives alongside related controls, evidence collection, and management review outcomes in one place.
Objectives like 'improve security culture' are hard to measure unless you define completion targets, role coverage, and behavior indicators (e.g., quiz results or repeat gaps). A structured training program helps by mapping course assignments to job functions and producing completion records for audits. For example, WatchDog Security's Security Awareness Training can assign role-based micro-courses and track completion and results against your defined clause 6.2 objectives.
"The organization shall establish information security objectives at relevant functions and levels. The information security objectives shall be consistent with the information security policy; be measurable (if practicable); take into account applicable information security requirements, and results from risk assessment and risk treatment; be monitored; be communicated; be updated as appropriate."
| Version | Date | Author | Description |
|---|---|---|---|
| 1.0.0 | 2025-05-27 | WatchDog Security GRC Team | Initial publication |
