Objectives

Current external reference: ISO/IEC 27001:2022

This is the 2022 clause a 2026 audit may use. It is not the 2020 layer and it is not the DIS text.

The organization must set security objectives for the functions and levels where they matter. They must agree with the policy, be measurable where practicable, reflect applicable security requirements together with what risk assessment and risk treatment have shown, be monitored, be communicated, be updated as needed, and exist as documented information, which the organization retains. When planning how to reach them it decides what will be done, the resources required, who is responsible, the completion date and how results will be evaluated.

How the 2020 guidance taught the audit

Auditors confirm that information security objectives are set at the relevant functions and levels; are expressed so that it can be judged whether they are met; are measurable where practicable (some cannot be measured); are monitored for status and progress under 9.1 and updated under 10.2 where needed; are communicated under 7.4; and are kept as documented information under 7.5. For the plans to achieve them, auditors confirm that what will be done and when is defined, that who is responsible is assigned under 5.3, that applicable security requirements and risk assessment and treatment results were taken into account, that budget, skills, technology and infrastructure needs are set under 7.1, and that the way overall results will be evaluated is set under 9.1 and reported through management review under 9.3. Objectives link back to leadership (5.1) and policy (5.2).

The DIS layer: the 2022 alignment

The DIS body and its annex numbering are not public. This is our reading of the public foreword and the 2022 clause record; where the public record is silent, the page says so.

The 2022 clause keeps the requirement for objectives and adds that they must be monitorable and updated as appropriate. The auditor now asks for the measure, not only the target.

Evidence an auditor asks for

• ObjectivesDocumented objectives per function and level with targets or completion criteria
• ObjectivesPlans stating actions, owners, timescales and resources for each objective
• ObjectivesProgress monitoring records and objective updates
• ObjectivesManagement review reports on objective achievement

The questions an auditor will ask

Ask for an objective, its measure, its current value and the decision it drove.

Common gaps

• Objectives too vague to tell whether they were achieved
• Plans with no owner, date or resources
• Objectives unrelated to risk assessment results
• Progress never measured or reported to management review

Prepare before the next audit

Rewrite each objective so it can be measured. Attach a value, a date and an owner.

Cross-references

5.2