ISO 27001 Clause 6.2 Information Security Objectives Implementation Checklist

In this ultimate how to implement guide to ISO 27001 Clause 6.2 Information Security Objectives and Planning to Achieve Them, you will learn directly from an ISO 27001 Lead Auditor:

1. Establish Clear and Relevant Objectives

Your first step is to define specific, measurable, and relevant objectives for your ISMS. These objectives must be directly aligned with your organisation’s strategic direction and overall business goals. The most effective way to structure these is by using the SMART framework:

• Specific: Clearly state what you want to accomplish.
• Measurable: Define how you will track progress.
• Achievable: Ensure the objective is realistic given your resources.
• Relevant: Ensure the objective supports broader goals.
• Time-bound: Set a clear deadline or timeframe.

Consultant’s Reality Check: While SMART is useful, don’t sacrifice significance for simple measurement. Identify what is most critical first, then work to make those objectives as SMART as possible.

2. Align Objectives with the Information Security Policy

Ensure that every information security objective is consistent with and supports your overarching Information Security Policy (Clause 5.2). A conflict between your policy and your objectives signals a fundamental misalignment that an auditor will quickly identify.

A practical way to ensure alignment is to document a primary, high-level objective directly within the Information Security Policy itself, for example: “To help prevent or minimise the impact of information security incidents or breaches to protect our business, reputation and to safeguard our people.“

3. Incorporate Risk Assessment Results

Your objectives must directly address the findings of your risk assessment and treatment activities (Clause 6.1). ISO 27001 is a risk-based framework at its core. Your objectives should be prioritised to tackle the most significant risks to the confidentiality, integrity, and availability (CIA) of your critical information.

4. Factor in All Applicable Requirements

Take into account all legal, regulatory, contractual, and other requirements when setting objectives. Examples include:

• Legal: Data protection laws like GDPR or CCPA.
• Regulatory: Industry-specific regulations like NIS2 or DORA.
• Contractual: Security commitments in SLAs or client contracts.

5. Assess and Allocate Necessary Resources

For each objective, determine what resources are required and ensure they can be allocated. An auditor will check that your planning is practical. Consider:

• Human resources: People and time.
• Financial resources: Budget for tools, expertise, or training.
• Technical resources: Software or hardware requirements.

6. Define Clear Roles and Responsibilities

Assign a specific person or role who will be responsible for achieving each objective. Without a clear owner, accountability is lost. Auditors expect to see a specific job title (e.g., “Operations Director”) assigned to each objective.

7. Establish Realistic Timeframes

Set a realistic timeframe or target date for completion. This adds urgency and a point for evaluation. Note that for continuous operational goals (like system availability), defining the timeframe as ‘ongoing’ is perfectly valid and often necessary.

8. Determine How Results Will Be Evaluated

Define precisely how you will measure and evaluate results. This bridges planning and proof. Whether using quantitative KPIs or qualitative reviews, the evaluation process must be defined, repeatable, and sufficient to determine success.

9. Communicate the Objectives Effectively

Communicate the objectives to all relevant parties. Use multiple channels such as inclusion in the Information Security Policy, Management Review Meetings, targeted communications, and awareness training.

10. Regularly Monitor, Review, and Update

Treat your objectives as living documents. Establish a formal schedule for reviews (e.g., quarterly) and make this a standing agenda item in your Management Review meetings (Clause 9.3). This ensures alignment with business strategy and the current risk landscape.

How to Document Your Objectives for an Audit

Auditors will require clear, documented evidence that you have established objectives and a concrete plan to achieve them. The table below outlines the essential attributes you must document for each objective.

Attribute	What to Document
Objective	State the clear, measurable objective itself.
What will be done?	Briefly describe the key actions or tasks required.
What resources will be required?	List the necessary people, time, and money.
Who will be responsible?	Name the specific person or role accountable.
When will it be completed?	Provide the target date or state “ongoing”.
How will the results be evaluated?	Describe the metrics, KPIs, or process for checking success.
How will the objective be monitored?	Explain how you will track progress over time.
How will the objective be communicated?	Note how and to whom the objective will be shared.

About the author