Clause 6.2 of ISO 27001 requires measurable information security objectives and a plan to reach them. Set a few top level objectives from what management wants, then add operational objectives for controls or processes. Keep a record that you measured them, and report results at management review.
What the clause asks for
The objectives are a mandatory document. They must be measurable at the top level and at the operational level, and there must be a plan for how you will achieve them. The objectives should come from what top management wants the ISMS to deliver, not from a template.
A five step way to set them
- Ask top management what the ISMS should achieve, for example fewer incidents, faster customer security reviews or a certificate by a given date.
- Turn those aims into measurable top level objectives.
- Use the Statement of Applicability to see which controls apply.
- Decide where operational objectives fit: single controls, groups of controls, processes or organisational units.
- Write the operational objectives with a measure each.
Examples of the shape
These are illustrations of structure, not targets to copy:
- Top level: every in scope system has a named owner by the end of the first quarter.
- Process: access reviews for production systems are completed on the schedule in the access policy.
- Control level: every release goes through the secure coding checks defined for the team.
- Unit level: all engineers complete the annual awareness course before a stated date.
Each one has a thing you can count and a date or interval. If you cannot say how you would measure it, it is a wish, not an objective.
What the auditor looks for
- A document that lists the objectives.
- Objectives that are measurable.
- Relevant staff who know the objectives that apply to them.
- Records showing the results were measured.
- Evidence that top management saw ISMS performance at the management review.
- Corrective actions raised when an objective is missed.
What you do not need
ISO 27001 does not require security KPIs, and the auditor will not look for them specifically. You need measurable objectives, which is a smaller and more useful thing. A handful that you track beats thirty that you do not.
Measurement links to clause 9.1, which asks you to evaluate how well your processes and the ISMS perform. Results flow into the management review, and misses should trigger corrective action.
Quick check
How many objectives do we need?
The standard does not set a number. Choose enough to cover what management cares about, and few enough that you really measure each one.
Can an objective be qualitative?
It must be measurable. If the measure is a yes or no outcome on a date, that can work. A vague aim like "improve security" does not.
Sources
Last reviewed: 19 October 2026.
