Clause 6.2 Information security objectives and planning to achieve them
Clause 6.2 in ISO 27001:2022 (ISO/IEC 27001:2022). All ISO 27001:2022 controls held. Open ISO 27001:2022 on the standards site.
The control as we hold it
Information security objectives and planning to achieve them. The organization must set security objectives for the functions and levels where they matter. They must agree with the policy, be measurable where practicable, reflect applicable security requirements together with what risk assessment and risk treatment have shown, be monitored, be communicated, be updated as needed, and exist as documented information, which the organization retains. When planning how to reach them it decides what will be done, the resources required, who is responsible, the completion date and how results will be evaluated.
Reviewed and closest counterparts in the other frameworks
We hold no cross-framework row for Clause 6.2 yet. The reviewed pairs page lists the released pairs and their coverage.
What an auditor commonly asks for
General guidance for this control area (domain: Clause 6), in our words, not a statement of the standard and not binding on an assessor.
- Written security objectives for each relevant function and level, consistent with the policy
- Measures or indicators for each objective and monitoring results
- Plans stating actions, resources, responsibility, target dates and evaluation method
- Evidence that objectives were communicated and updated