A Guide for AI Companies to ISO 27001 Clause 6.2: Setting Security Objectives That Matter

For an AI company, your value isn’t just in your product; it’s in the terabytes of curated data and the unique architecture of your proprietary models. The theft of a pre-trained model or the subtle poisoning of a dataset isn’t just an incident; it’s an existential threat. In this context, ISO 27001 Clause 6.2 is not a bureaucratic hurdle to be cleared, but a strategic imperative.

It provides the framework for defining what “secure” truly means for your organisation. By setting clear security objectives, you create a focused strategy to protect your intellectual property, ensure the reliability of your AI-powered services, and build the foundational customer trust necessary for growth. This guide will demystify Clause 6.2, providing a practical, no-jargon roadmap for setting meaningful security objectives that actively support your unique business goals.

Decoding Clause 6.2: The “What” and “Why” of Your Security Strategy

Understanding the core components of Clause 6.2 is the first step towards creating an Information Security Management System (ISMS) that is both robust and effective. This clause moves beyond generic security statements and requires you to articulate precisely what you want to achieve and how you plan to get there. It is, in essence, the “why” behind your entire security programme.

The Formal Definition

The standard officially requires organisations to establish information security objectives at relevant functions and levels. These objectives must be consistent with the information security policy, measurable (if practicable), monitored, communicated, and updated as appropriate.

Breaking It Down

This clause has two fundamental parts that work together:

• Establishing Objectives: This is about defining what you want your ISMS to accomplish. These objectives articulate the desired outcomes and provide the strategic direction for your security efforts. This is the “why” that drives your ISMS.
• Planning to Achieve Them: This is about creating a concrete, documented action plan. For each objective, you must detail how you will achieve it, including who is responsible, what resources are needed, and how you will measure success.

Your ISMS Roadmap

Think of Clause 6.2 as the roadmap for your organisation’s security programme. The objectives set the destination—what you aim to achieve—while the plan defines the specific route you will take to get there. Toolkits like Hightable.io are designed to centralise this roadmap, ensuring that your objectives aren’t just written in a static document but are actively tracked and managed.

Structuring Your Objectives: A Two-Level Approach

Not all objectives are created equal, nor should they be. A practical and highly effective way to approach Clause 6.2 is to structure your objectives at two distinct levels: a high, strategic level and a more detailed, operational level. This approach provides both a clear, overarching mission and the flexibility to address specific risks and processes.

The High-Level Objective

It is often beneficial to establish a single, overarching objective for the entire ISMS. This high-level goal is typically documented directly within the Information Security Policy, anchoring the entire system to a core business principle.

An excellent example of such an objective is:

“To help prevent or minimise the impact of information security incidents or breaches to protect our business, reputation and to safeguard our people.”

The value of this approach is its clarity and focus. It connects all subsequent security activities back to the fundamental goal of protecting the business, its reputation, and its personnel.

Detailed & Operational Objectives

These are more specific objectives that typically emerge from your risk assessment and treatment process (Clause 6.1). They are designed to address particular threats or strengthen specific controls. However, it is crucial to apply a pragmatic filter here.

You should only create detailed, documented objectives if they provide a tangible benefit to the organisation. The goal is not to generate a long list for the sake of compliance, but to define targeted objectives where they will actively help achieve the top-level mission. Formally defining an objective allows you to report progress on critical initiatives to senior management effectively.

The Blueprint for Action: How to Define and Document Your Objectives

Proper documentation is not just an exercise for the auditor; it is a critical management tool. A well-defined plan for each objective ensures clarity, assigns accountability, and provides a clear benchmark for evaluating success. This turns your security goals from abstract statements into a tangible blueprint for action.

To ensure compliance and practicality, your documented plan for each objective must answer the following key questions. Using a compliance management tool like Hightable.io can simplify this process by providing structured templates for these elements:

• What will be done? Provide a clear, concise sentence describing the specific action or initiative.
• What resources will be required? List the high-level needs, such as engineering time, specific software, or allocated budget.
• Who will be responsible? Assign a specific person’s name or role (e.g., Head of Data Science, Lead MLOps Engineer).
• When will it be completed? Set a target completion date, or note if it is an ongoing, continuous activity.
• How will results be evaluated? Define what success looks like and how you will measure it (e.g., penetration test results, uptime metrics).
• How will it be monitored? Define the process for tracking progress (e.g., monthly review, dashboard metric).
• How will it be communicated? Identify the channels and audiences for communication (e.g., all-hands meeting, management report).

The SMART Objectives Debate: A Pragmatic View for AI Companies

While the “SMART” framework is a widely known tool for objective-setting, there is a nuanced debate about its application within ISO 27001. Understanding this debate can help AI companies avoid common pitfalls and create objectives that are genuinely meaningful, rather than just easy to measure.

What are SMART Objectives?

SMART is an acronym that stands for: Specific, Measurable, Achievable, Relevant, and Time-bound.

The Case Against Strict Adherence

The primary risk of focusing too heavily on the SMART framework is that it can lead you to choose objectives that are easily measurable over those that are strategically important. In consulting practice, teams often get paralysed by trying to make every objective perfectly SMART. Consider the analogy: “Keep my family happy.” This goal is vital, but it fails most of the SMART criteria—it isn’t easily “measurable” or “time-bound” in a conventional sense. Prioritising a less important but perfectly SMART objective would be a mistake.

The Auditor’s Perspective

It is important to know that ongoing objectives are perfectly valid under ISO 27001. Some auditors may incorrectly insist that every objective must have a fixed end date or be strictly SMART. This is not a requirement of the standard. An objective like protecting the business from security incidents is, by its nature, continuous.

A Balanced Recommendation

Use the SMART framework as a helpful guide to bring clarity and focus to your objectives, but do not treat it as a rigid constraint. It is far better to have a strategically vital objective that isn’t perfectly “SMART” than a perfectly “SMART” objective that isn’t important. The most important objectives for an AI company will always relate to protecting its core assets: data, models, and infrastructure.

---

---

Tailoring Objectives for AI: Protecting Your Core Assets

For an AI company, the foundational principles of information security—Confidentiality, Integrity, and Availability (the CIA triad)—have specific and critical applications. Translating this triad into tangible objectives is the key to protecting the assets that define your business.

Confidentiality: Protecting Your Secrets

Confidentiality ensures that information is protected from unauthorised access. For an AI company, this is about safeguarding your intellectual property.

Example Objective: “To prevent the exfiltration of proprietary models and sensitive training data, we will implement data loss prevention (DLP) rules that trigger alerts on the unusual movement of large model files (e.g., .pt, .safetensors) and conduct mandatory exit interviews focused on IP with all departing technical staff.”

Integrity: Trusting Your Data and Models

Integrity refers to the accuracy and reliability of information. In the AI world, this is crucial for preventing issues like data poisoning or model drift that can render your technology useless or even dangerous.

Example Objective: “To maintain model integrity and prevent data poisoning attacks, we will implement statistical drift detection on all incoming training data streams, aiming to keep data anomalies below a 0.1% threshold.”

Availability: Ensuring Your Service is Online

Availability means that information and services are accessible to authorised users when needed. For an AI company providing a service, this directly translates to uptime and customer satisfaction.

Example Objective: “To ensure uninterrupted service and defend against resource exhaustion attacks, we will maintain a minimum of 99.5% uptime for production API endpoints and implement rate limiting to protect against inference-based denial-of-service (DoS) attacks.”

Preparing for the Audit: What Will They Really Check?

Understanding an auditor’s focus allows you to prepare your evidence effectively and demonstrate that your ISMS is a living, breathing part of your organisation, not just a set of documents gathering dust. An auditor’s goal is to verify that your objectives are defined, implemented, and effective.

Here is a checklist of what an auditor is likely to ask for regarding Clause 6.2:

• Are your information security objectives formally documented? They will want to see the specific document or system where the objectives and their corresponding plans are recorded. Hightable.io serves as an excellent repository for this evidence.
• Are they clearly aligned with business goals? An auditor will check for a clear, logical thread connecting what the business wants to achieve and the security objectives you have set.
• Can you provide evidence that you are monitoring progress? An auditor will expect to see management review minutes, performance dashboards, or KPI reports.
• If an objective was not met, can you show what you did about it? Evidence of a corrective action or a revised plan demonstrates that your ISMS is a dynamic and responsive management system.
• Are relevant employees aware of the objectives? The auditor may interview staff to confirm that objectives have been communicated and are understood at the functional level.

Conclusion: Turning Objectives into Your Strategic Advantage

Ultimately, ISO 27001 Clause 6.2 is far more than a compliance checkbox; it is a powerful tool for building a more resilient, trustworthy, and secure AI business. When crafted with care, information security objectives become the strategic compass for your entire security programme. They transform abstract goals into concrete actions, ensuring that your efforts are focused on what matters most. For an AI company, well-defined objectives protect vital intellectual property, ensure the integrity and availability of your services, and provide a clear roadmap for sustainable growth in a highly competitive landscape.

About the author

Stuart Barker is a veteran practitioner with over 30 years of experience in systems security and risk management.

Holding an MSc in Software and Systems Security, Stuart combines academic rigor with extensive operational experience. His background includes over a decade leading Data Governance for General Electric (GE) across Europe, as well as founding and exiting a successful cyber security consultancy.

As a qualified ISO 27001 Lead Auditor and Lead Implementer, Stuart possesses distinct insight into the specific evidence standards required by certification bodies. He has successfully guided hundreds of organizations – from high-growth technology startups to enterprise financial institutions – through the audit lifecycle.

His toolkits represents the distillation of that field experience into a standardised framework. They move beyond theoretical compliance, providing a pragmatic, auditor-verified methodology designed to satisfy ISO/IEC 27001:2022 while minimising operational friction.