Zum Hauptinhalt springen
CENEDRIL WIKI
DE
Starter Kit · Register

Security Objectives Register

Updated on 2 min Reviewed by: Cenedril-Redaktion
Clause 6.2Clause 9.1 ISO 27001NIS2 Art. 21

Clause 6.2 requires your ISMS to have documented information security objectives — and a plan for how to achieve them. The security objectives register is where objective, metric, responsibility, and deadline converge. Without this register, information security remains an intention without direction.

What does it contain?

The template maps the requirements of Clause 6.2 directly into columns:

  • Objective — what should be achieved? (e.g. reduce mean time to recovery to < 4 hours)
  • Policy reference — which principle of the information security policy does this objective support?
  • Metric / KPI — how is progress measured? (e.g. MTTR in hours, training completion rate in percent)
  • Target value — what value should be reached?
  • Responsible person — who drives achievement of the objective?
  • Resources — what is needed? (budget, personnel, tools)
  • Deadline — by when should the objective be achieved?
  • Status — current degree of fulfilment

How to use the template

1. Formulate objectives. Derive them from three sources: the information security policy (Clause 5.2), the risk assessment (Clause 6.1), and stakeholder requirements (Clause 4.2). Each objective should have a clear link to at least one of these sources.

2. Define metrics. For each objective: which KPI shows progress? Availability percentage, number of security incidents, mean response time, training completion rate, patch cycle time. Choose metrics you can actually collect — with the data available to you.

3. Set responsibilities and deadlines. An objective without a responsible person and a deadline is a wish. Every row in the register needs both.

4. Present in the management review. Clause 9.3 requires that the results of security objectives are addressed in the management review. The register is the basis for this discussion — bring it up to date.

5. Adjust annually. Objectives that have been met are replaced by new ones. Objectives that were missed are analysed: was it resources, the target value, or the implementation? This analysis belongs in the management review minutes.

Register Template

Security Objectives Register

.csv · EN.csv · DE
IDObjectiveLinked ISO Clause / RiskOwnerMetricBaseline (start of year)TargetMeasurement FrequencyCurrent ValueStatusReview DateLinked Action
OBJ-2026-01Reduce phishing simulation click rate below 5%ISO 6.2 + R-002ISO% of users clicking simulated phishing5.8% (2025-12)<5% by 2026-12-31Quarterly4.2% (2026-Q1)On track2026-06-30RTP-005
OBJ-2026-02Achieve 100% phishing-resistant MFA for all admin accountsISO 6.2 + R-001 + R-002ISO% of admin accounts on FIDO20% (2025-12)100% by 2026-06-30Monthly48% (2026-04)On track2026-06-30RTP-001
OBJ-2026-03Roll out FIDO2 to all staffISO 6.2 + R-002ISO% of users with FIDO2 enrolled0% (2025-12)100% by 2026-09-30Monthly12% (2026-04)On track2026-09-30RTP-004
OBJ-2026-04Close all critical and high vulnerabilities within SLA for two consecutive quartersISO 6.2 + A.8.8IT Operations Lead% of vulns closed within SLA89% (2025-Q4)100% in 2026-Q3 and Q4Monthly92% (2026-Q1)Behind2026-09-30CAPA-2026-004
OBJ-2026-05Pass external surveillance audit with no major findingsISO 9.2 + 9.3ISONumber of major findings1 (2025 audit)0 in 2026AnnualPending auditPending2026-05-18
OBJ-2026-06Increase awareness training completion above 95%A.6.3HR Lead% of staff completing annual awareness training93% (2025)>95% by 2026-12-31Quarterly96% (2026-Q1)Achieved2026-12-31
OBJ-2026-07Reduce mean time to detect (MTTD) for security incidents below 2 hoursISO 6.2 + A.5.25ISOHours from incident occurrence to detection (median)2h 45min (2025)<2h by 2026-12-31Quarterly1h 35min (2026-Q1)Achieved2026-12-31
OBJ-2026-08Qualify a second logistics SaaS provider as standbyR-004 + A.5.30ProcurementProvider qualified (yes/no)NoYes by 2026-12-31QuarterlyVendor shortlist agreedOn track2026-12-31RTP-008
OBJ-2026-09Achieve 100% supplier security review coverage for critical suppliersA.5.22Procurement% of critical suppliers reviewed within 12 months80% (2025)100% by 2026-12-31Quarterly92% (2026-Q1)On track2026-12-31
OBJ-2026-10Run two BCM exercises per year for critical processesA.5.29 + A.5.30BCM LeadNumber of exercises per year1 (2025)2 by 2026-12-31Annual1 completed (2026-Q2)On track2026-12-31

Sources

ISO 27001 Controls Covered

Clause 6.2 Information security objectives Clause 9.1 Monitoring, measurement, analysis and evaluation

Frequently asked questions

What does Clause 6.2 specifically require?

Information security objectives must be consistent with the information security policy, measurable (where practicable), take into account the results of the risk assessment, be communicated, and be updated regularly. You must also document what will be done, what resources are needed, who is responsible, when the objectives should be achieved, and how results will be evaluated.

How many security objectives do I need?

No fixed number. Five to ten well-formulated objectives are a solid starting point for most organisations. More important than quantity: each objective must be measurable and linked to a responsible person. Ten vague statements of intent are less useful than three precise, measurable objectives.

Do all objectives need to be quantitative?

Clause 6.2 says 'where practicable'. An objective like 'ERP system availability ≥ 99.5%' is quantitatively measurable. An objective like 'All employees complete awareness training by Q3' is also measurable — as yes/no. The key is that you can assess the degree of fulfilment.