ISO 27001 security objectives
Vague security objectives do not survive an audit. We help you write SMART objectives that connect to risks and the organization’s strategy.
What we see too often
Objectives such as “improve security” do not survive a management review, let alone an audit. With no indicator, no target and no calendar, clause 6.2 stays an intention.
- objectives copied from a template, with no link to retained risks
- KPIs nobody can measure, or that are calculated once a year
- no review: the figures never reach leadership
- too many objectives, so no real follow-up
- confusion between a business goal, an operational indicator and a wish
What this module is
ISO 27001 security objectives are measurable targets, aligned with issues and risks, with indicators and reviews. They tell leadership whether the ISMS is moving, not whether someone “worked well”.
For an SMB, a few followed objectives beat a long forgotten list. We write them SMART, with a data source you already have or can collect without a factory of tools.
Where this sits in ISO 27001
The module covers clause 6.2 (objectives) and prepares the management review in clause 9.3. It does not replace the risk register or the internal audit.
What this module includes
- Review of business issues and retained risks
- SMART objectives tied to the ISMS
- Indicators you can actually measure
- Review calendar with leadership
How we work
Review of issues and risks
We start from what is already decided (or we scope it quickly): what leadership wants to protect, what it has accepted to treat.
SMART wording
Precise objectives, tied to the ISMS, with a target and a date. We drop the cosmetic ones.
Indicators and sources
Table: what to measure, where it lives, who collects it, how often. If you cannot measure it, it is not an objective.
Review calendar
Minute template for management review. Objectives exist when someone reads them and adjusts them.
What you receive
- SMART objectives sheet (clause 6.2)
- Indicator table with data sources
- Periodic review calendar
- Management-review minute template
Who it is for
Leaders who want simple indicators, and ISMS owners who need a credible management review.
Who it is not for
This module is not a SIEM dashboard, nor a digital transformation programme. It does not write the risk register for you.
Typical duration
1 to 3 weeks after an initial risk analysis.
What you need to provide
You bring retained risks (even a draft), indicators you already track, and a leadership slot to validate targets.
What this module does not cover
This module sets objectives and indicators. It does not replace the risk register or the internal audit.
Frequently asked questions
- How many objectives do we need?
- A few tracked objectives beat a long forgotten list. For an SMB, 4 to 8 risk-linked objectives are often enough.
- Can we reuse existing KPIs?
- Yes, if they truly measure a security issue. We drop cosmetic metrics and keep what is verifiable.
- Who approves the objectives?
- Leadership. Without approval, an auditor will see intentions, not a directed ISMS.
- Can we buy only this module?
- Yes. Each module is sold separately. You do not have to buy the full programme. The pre-assessment remains the most efficient entry point if you do not yet know where to start.
- Do we have to start with the pre-assessment?
- No, it is not mandatory. The pre-assessment speeds up scoping if you do not yet have a full picture. If you already know what is missing, we can start this module directly.