ISO 27001 information security objectives: examples and how to set them

Information security objectives are the few things your organisation commits to achieving with its ISMS over a set period, stated so you can tell whether you got there. They turn "we take security seriously" into targets someone owns and reports on.

Most small organisations need three to six. More than that and they stop being priorities.

Why it matters

Objectives come from clause 6.2 of ISO/IEC 27001:2022. In summary, the standard asks that your objectives:

• Are consistent with your information security policy.
• Are measurable, where that's practical.
• Take account of your security requirements and the results of your risk assessment and treatment.
• Are monitored, communicated, and updated as needed, and kept as documented information.

For each one, you plan what will be done, what resources it needs, who is responsible, when it will be completed, and how the results will be evaluated. Your management review (clause 9.3) then looks at progress.

What an auditor looks for

• Objectives that are measurable, or at least checkable. "Improve security" isn't an objective; "complete a restore test of every production system each quarter" is.
• A plan behind each one: owner, resources, deadline and how it's measured.
• Evidence of monitoring. Progress recorded over time, and discussion at management review.
• A link to your risks and context. Objectives should reflect what matters to your business, not a generic list.
• People know about them. Staff involved can say what the objectives are, at least the ones that affect them.

Common reasons it fails: objectives with no measure; objectives set once and never reviewed; or targets met on paper with no record of how they were checked.

Examples

Illustrative examples for a small organisation. Adapt them; don't copy them.

• Every staff member completes security awareness training within 30 days of joining, and refreshes it every year. Measured by training records each quarter.
• Restore from backup tested for every production system each quarter, with any failure fixed within 10 working days. Measured by restore test records.
• All critical security patches applied within 14 days of release. Measured by the monthly patch report.
• Answer customer security questionnaires within 5 working days. Measured by the questionnaire log.
• No more than two overdue actions from internal audits at any time. Measured at each management review.

Common mistakes, and how to keep it manageable

• Too many objectives. Pick the ones that would most improve security or win business.
• Measures you can't collect. Choose measures that come from records you already keep, so reporting takes minutes.
• Objectives that never change. Once you reliably hit one, raise the bar or replace it.
• No owner. Every objective needs one person who reports on it.

How to do it in ClearIMS

1. Open Security objectives and add each objective in plain words.
2. Plan it. For each one, record what will be done, the resources, an achieve-by date and how it will be evaluated. ClearIMS won't let an objective close until it has been planned and measured.
3. Assign the work. Turn the actions into tasks with owners and due dates, so ClearIMS emails people when they're due.
4. Approve and review. A named person approves each objective, with an approval record. Review progress at each management review.

Related pages

• Management reviews: where progress on objectives is reviewed.
• Reports: how you show progress over time.
• Improvement log: what you change when an objective is missed.
• Interested parties: whose requirements your objectives serve.