Measurable targets an organization sets to improve information security, consistent with its security policy.
ISO/IEC 27001 requires objectives that are measurable, monitored, communicated, and updated. Examples include reducing the time to patch critical vulnerabilities or increasing the completion rate of awareness training.
Good objectives turn a policy's intentions into concrete outcomes that can be tracked. They are reviewed during management review and provide evidence that the ISMS is improving rather than standing still.
Related frameworks
KaitoSec