At its core, ISO 27001 Clause 6.2 is not about bureaucratic box-ticking; it is about defining the very purpose—the ‘why’—of an organisation’s Information Security Management System (ISMS). This clause requires an organisation to establish clear, actionable information security objectives, effectively creating a strategic roadmap for its security efforts.
For an auditor, this is a critical point of evaluation. A well-implemented Clause 6.2 signals an ISMS that is deeply integrated with business goals and driven by tangible outcomes. Conversely, a weak or superficial approach to this clause is often a leading indicator of an ISMS that exists only on paper—a collection of documents disconnected from the operational realities of the business. Understanding how to audit these objectives is key to assessing whether an ISMS is a genuine asset or a costly compliance exercise.
Table of contents
Deconstructing the Core Requirements of Clause 6.2
Before an audit can begin, a complete and granular understanding of the standard’s requirements is non-negotiable. An auditor must be able to dissect the clause into its component parts to form a coherent basis for inquiry. This section breaks down the specific mandates of Clause 6.2, building a foundational checklist that will guide the evidence-gathering and evaluation process.
The Seven Characteristics of Effective Objectives
ISO 27001 specifies that information security objectives must possess seven distinct characteristics. These are not merely suggestions; they are auditable requirements. From an auditor’s perspective, each one provides a different lens through which to evaluate the maturity and effectiveness of the ISMS.
- Be consistent with the information security policy: This ensures that top-level strategic intent, as signed off by management, is directly aligned with the operational goals being pursued.
- Be measurable (if practicable): Measurability is critical for moving beyond vague aspirations and enabling the objective evaluation of performance against defined targets.
- Take into account applicable information security requirements, and risk assessment and risk treatment results: This establishes a clear and logical link between the organisation’s objectives and its specific risk landscape, ensuring that effort is directed where it is needed most.
- Be monitored: This is essential for tracking progress over time, allowing for course correction and demonstrating that the objectives are actively managed rather than “set and forget.”
- Be communicated: This is vital for ensuring that objectives are understood and acted upon by individuals at all relevant functions and levels of the organisation.
- Be updated as appropriate: This requirement ensures the ISMS remains agile and that its objectives stay relevant in a dynamic business environment and a changing threat landscape.
- Be available as documented information: This is the primary evidence an auditor will seek to confirm that the objectives and the plans to achieve them are formally established and maintained.
The Five Pillars of a Successful Action Plan
Beyond defining the objectives themselves, Clause 6.2 mandates a clear plan for achieving them. An auditor must verify that for each objective, the organisation has determined the following five components.
- What will be done: This requires a clear definition of the specific tasks and actions required to meet the objective.
Auditor’s Question: Is there a clear description of the actions and tasks required to achieve this objective? - What resources will be required: This involves the allocation of necessary personnel, budget, and time.
Auditor’s Question: Has the organisation realistically assessed the need for people, time, and money? - Who will be responsible: Accountability is crucial for ensuring that objectives are driven forward.
Auditor’s Question: Is a specific person or role assigned clear accountability for the outcome? - When it will be completed: This provides a timeframe for achievement, whether it is a fixed date or an ongoing commitment.
Auditor’s Question: Is there a target date or a clear statement for ongoing objectives? - How the results will be evaluated: This defines the metrics and methods for determining if the objective has been successfully met.
Auditor’s Question: Are there defined methods and metrics to determine if the objective has been met?
Understanding these requirements provides the ‘what’ of the audit. The next step is to explore the ‘how’—navigating the real-world interpretations and applications an auditor will encounter.
The Auditor’s Mindset: Navigating Common Interpretations and Debates
The ISO 27001 standard provides the requirements, but it does not dictate a single method for meeting them. Consequently, how organisations choose to implement Clause 6.2 can vary significantly. A seasoned auditor understands that there is often more than one way to achieve compliance.
The “SMART” Objective Debate
The SMART (Specific, Measurable, Achievable, Relevant, Time-bound) framework is a widely recommended tool for setting objectives, and many organisations adopt it for their ISMS. However, an auditor should be prepared for differing philosophies on its application.
The Argument For SMART: Proponents, like consultant Stuart Barker, advocate for the SMART structure because it forces clarity and discipline. From an audit perspective, SMART objectives are straightforward to verify. Their specificity, measurability, and time-bound nature provide clear, easily auditable evidence of compliance and performance.
The Counter-Argument: Conversely, some experts, such as consultant Chris Hall, caution that rigidly forcing all objectives into the SMART framework can be counterproductive. It can lead organisations to choose easily measurable goals over truly important ones. Hall illustrates this with a personal analogy: an objective to “Keep my wife happy” is a profoundly important and “smart” (lowercase) goal, but it does not fit neatly into the specific, time-bound criteria of the formal SMART acronym.
As an auditor, the key is to focus on effectiveness. Rather than rigidly insisting on the SMART acronym, the primary concern should be whether the chosen objectives add real value, are aligned with business needs, and are being effectively managed and evaluated by the organisation.
The Myth of the Mandatory End Date
A common misconception, sometimes perpetuated by auditors themselves, is that every objective must have a fixed completion date. This is not a requirement of the standard and can constrain an organisation from setting meaningful, long-term security goals.
As Chris Hall points out, some of the most important objectives are ongoing. For example, an objective like, “To help prevent or minimise the impact of information security incidents…” is a perfectly valid and critical goal that has no logical end date.
An auditor’s role is not to enforce an arbitrary deadline where one is not logical. For ongoing objectives, the key evidence lies in the plans for monitoring and evaluation. The auditor should verify that the objective is being actively managed, tracked, and reviewed, demonstrating a continuous commitment to the security posture it represents.
The Audit Process: A Step-by-Step Evidence Trail
With a firm grasp of the requirements and common interpretations, the auditor can proceed with a structured methodology for gathering evidence. This section provides a core ‘how-to’ guide for executing the audit of Clause 6.2, outlining a logical progression from document review to interviews and performance verification.
Phase 1: Document Review
The audit typically begins with a review of the documented information that forms the backbone of the ISMS. The following documents are essential for assessing compliance with Clause 6.2.
- Information Security Policy: Scrutinise this high-level document to verify that the organisation’s core information security objectives are documented and are consistent with the policy’s overall purpose and principles.
- “Information Security Objectives” Document: Analyse this central document, which should list the formal objectives and detail the plan for each one, covering the “what, who, when, how” elements required by the standard.
- Risk Assessment & Treatment Plan: Examine these to verify that the objectives fulfill the requirement of Clause 6.2 c) by explicitly taking into account the results of the risk assessment and risk treatment plan. The auditor must see a clear, traceable line from high-priority risks to the objectives designed to mitigate them.
- Management Review Meeting Minutes: Review these records for tangible evidence that the objectives are being actively tracked, discussed, measured, and reviewed by senior leadership, confirming they are part of a live management process.
Phase 2: Interviews and Corroboration
Documents tell one part of the story; interviews reveal how the ISMS operates in practice. The auditor must speak with key personnel to corroborate the documented evidence and assess the level of awareness and engagement throughout the organisation.
| Personnel to Interview | Key Audit Questions to Ask |
|---|---|
| Top Management / C-Suite | “How do these security objectives support your business goals? How do you monitor progress against them?” |
| Information Security Manager | “Can you describe the lifecycle of a key objective? How do you ensure objectives are regularly updated for relevance?” |
| Staff at ‘Relevant Functions and Levels’ | “Can you describe the security objectives relevant to your role and how your work helps achieve them?” |
Phase 3: Performance Evaluation
The final step is to verify that the evaluation process is not just a plan, but a reality. The auditor must seek proof that objectives are being measured and that the results are being used to drive improvement.
- Request the outputs of the evaluation process, such as Key Performance Indicator (KPI) reports, performance dashboards, or summary statistics presented to management.
- Crucially, check what was done if objectives were not met. Look for evidence of corrective actions, root cause analysis, or adjustments to the plan. This demonstrates a functioning, continually improving ISMS and is a hallmark of a mature security program.
DO IT YOURSELF
STOP SPANKING £10,000s on CONSULTANTS and ISMS ONLINE PLATFORMS
Identifying Common Red Flags and Nonconformities
A skilled auditor looks not just for what is present, but for what is missing. The absence of certain characteristics or the presence of specific warning signs can indicate a weakness in the ISMS. This section outlines common pitfalls related to Clause 6.2 that can signal a superficial or ineffective implementation.
- Objectives Exist in Isolation. The objectives are documented but have no clear, traceable link to the organisation’s business goals or its risk assessment. This indicates a siloed, ‘compliance-for-compliance’s-sake’ approach.
- “Set and Forget” Objectives. The objectives were documented when the ISMS was first established and have not been reviewed or updated since, despite significant changes in the business, technology, or threat environment. This demonstrates a lack of continual improvement.
- Unrealistic or Unmeasurable Goals. The objectives are either hopelessly vague (e.g., “Improve security”) or wildly ambitious with no corresponding allocation of resources, budget, or personnel. This shows a fundamental lack of practical planning.
- Lack of Awareness. When interviewed, staff members—and sometimes even line managers—are unaware of the information security objectives, particularly those relevant to their roles. This is a critical failure in communication (Clause 6.2 e).
Conclusion: From Compliance to Organisational Value
Auditing ISO 27001 Clause 6.2 is about much more than checking items off a list. It is a strategic assessment of the direction, purpose, and effectiveness of the entire Information Security Management System. The process involves deconstructing the standard’s requirements, understanding the practical nuances of implementation, following a rigorous evidence trail, and identifying the red flags that signal a weak security posture. When properly established and managed, information security objectives transform an ISMS from a costly obligation into a genuine organisational asset—one that provides a clear framework for reducing risk, building resilience, and adding demonstrable value to the business.
About the author
Stuart Barker is a veteran practitioner with over 30 years of experience in systems security and risk management.
Holding an MSc in Software and Systems Security, Stuart combines academic rigor with extensive operational experience. His background includes over a decade leading Data Governance for General Electric (GE) across Europe, as well as founding and exiting a successful cyber security consultancy.
As a qualified ISO 27001 Lead Auditor and Lead Implementer, Stuart possesses distinct insight into the specific evidence standards required by certification bodies. He has successfully guided hundreds of organizations – from high-growth technology startups to enterprise financial institutions – through the audit lifecycle.
His toolkits represents the distillation of that field experience into a standardised framework. They move beyond theoretical compliance, providing a pragmatic, auditor-verified methodology designed to satisfy ISO/IEC 27001:2022 while minimising operational friction.
