Control 6.2Information security objectives and planning to achieve them

Establish information security objectives at relevant functions and levels. They must be consistent with the policy, measurable where practicable, take account of applicable requirements and the results of risk assessment and treatment, be monitored, communicated and updated as appropriate, and be available as documented information. The organisation must determine what will be done, what resources are required, who is responsible, when it will be completed and how the results will be evaluated.

“Measurable where practicable” is the phrase organisations lean on hardest and are challenged on most. An objective such as “improve security awareness” states a direction, not an objective; the planning elements the clause then lists — what, who, when, how evaluated — cannot be completed against it.

The link to 9.1 is what makes this clause real: monitoring and measurement must evaluate the ISMS performance against these objectives. Objectives that cannot be measured produce a monitoring programme that measures activity instead.

How to put this in place

Objectives turn the policy into things that can be measured. Vague aims that nobody measures cannot show that the ISMS works.

Choose a small number of objectives that follow from the policy and the risks.
Give each a measure, a target, an owner, resources and a date.
Approve them and tell the people who deliver them.
Start measuring when the controls run.
Review results at the management review and adjust.

Evidence an auditor usually looks for: a list of measurable objectives with owners and dates, evidence they are communicated, and results reviewed.

What is in the packs for this

From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.

ISO 27001 Implementation Methodology & Project PlanWord
Covered in Phase 3 (Select and document controls) of the implementation plan, which sets out the work and the gate that closes the phase.
Mandatory ISMS Documentation ChecklistExcel
Required Documents sheet, item MD-07: the typical form, what auditors accept instead and the gaps they reliably find.
Certification Readiness Self-AssessmentExcel
A blocking item in the readiness assessment, which treats it as needing to be operating before a Stage 2 audit.
Stage 1 and Stage 2 Audit Preparation GuideWord
Listed in the table of what an auditor is likely to ask for and sample, by clause, with the likely challenge.