Information security objectives and planning to achieve them

What the requirement asks

The organization must set security objectives for the functions and levels where they matter. They must agree with the policy, be measurable where practicable, reflect applicable security requirements and the results of risk assessment and treatment, be monitored, be communicated, be updated as needed, and exist as documented information, which the organization retains. When planning how to reach them it decides what will be done, the resources required, who is responsible, the completion date and how results will be evaluated.

What the guidance adds

Objectives are expected to be specific enough to measure and owned by someone who can move them. The guidance asks what will be done, what resource is needed, who is responsible, when it will be finished and how the result will be evaluated. An objective with no measure is a slogan.

What good looks like

Keep written security objectives for each relevant function and level, consistent with the policy with the clause record, and give it an owner and a review date.

Evidence an assessor asks for

• Security objectivesWritten security objectives for each relevant function and level, consistent with the policy
• Security objectivesMeasures or indicators for each objective and monitoring results
• Security objectivesPlans stating actions, resources, responsibility, target dates and evaluation method
• Security objectivesEvidence that objectives were communicated and updated

The question an assessor will ask

An assessor will ask for written security objectives for each relevant function and level, consistent with the policy. The test for 6.2 is whether that record can be produced for a live sample, not whether the clause is described in a procedure.

Common gaps

• Objectives are vague statements that cannot be measured
• No plan states who does what by when
• Objectives are not informed by risk assessment results
• Progress is never monitored

Before the next audit

Before the next audit, test this against one live record: objectives are vague statements that cannot be measured.