Glossary · Foundations
Information Security Objectives
Measurable targets an organisation sets to improve information security, consistent with its security policy.
Put the term into practice: Risk management software
ISO/IEC 27001 requires objectives that are measurable, monitored, communicated, and updated. Examples include reducing the time to patch critical vulnerabilities or increasing the completion rate of awareness training.
Good objectives turn a policy's intentions into concrete outcomes that can be tracked. They are reviewed during management review and provide evidence that the ISMS is improving rather than standing still.
