Information security objectives record what your organisation wants to achieve by when, who is responsible for it and how you measure progress (ISO/IEC 27001, clause 6.2). This guide explains how you define objectives, record measured values and evaluate objectives in Varmo. It is aimed at ISMS managers and at people responsible for an objective.

Before you start

  • You will find the objectives under ISMS management › Objectives.
  • People with the “Objectives: Manage” permission may define, change and evaluate objectives; by default, these are the ISMS managers. By default, top management and “Internal audit & review (read only)” may also read them.
  • Anyone responsible for an objective sees it under My objectives even without this permission, records measured values and evaluates it.
  • Objectives are included in all plans.

Defining an objective

  1. Open Objectives and click Define objective.
  2. Name the Objective, for example “Awareness of all employees”. Under Why? Link to the policy, record which concern of the information security policy or which risk the objective addresses. Optionally, link a Policy.
  3. Define the measurement: Metric (e.g. “Training rate”), Baseline, Target value, Unit, whether Higher is better or Lower is better applies, the frequency under Measurement (monthly, quarterly, half-yearly or annually) and First measurement by.
  4. Choose who is Responsible and the date for Achieve by.
  5. Describe the planning (ISO/IEC 27001, 6.2): What will be done?, Resources and How will it be evaluated?.
  6. Click Save.

You then assign specific measures on the objective's page under Measures for the objective. Conversely, you can also record on a measure, in the “Objectives” section, which objective it contributes to, see Implementing and evidencing measures.

Recording measured values

  1. Open the objective and click Record measured value.
  2. Enter the Value, Measured on and optionally a Note, for example the source of the figure.
  3. Save. Varmo sets the next measurement date according to the frequency.

The objective's page shows all Measured values and the progress towards the target value.

Evaluating an objective

On the due date, you evaluate the objective:

  1. Click Evaluate objective.
  2. Choose the result: Achieved, Not achieved or Discontinued (no longer relevant).
  3. Justify the evaluation, for example “97 % achieved; mandatory training is established.” The justification is required.

What happens next

  • The responsible person receives the task Define measures for the objective as long as no measure is assigned to the objective.
  • 7 days before each measurement date, they receive the task Record measured value, then Measurement overdue. On the due date, Evaluate objective follows.
  • If there is no responsible person, people with the permission to manage objectives receive the task Assign responsible person.
  • Measured values and results feed into the next management review, see Preparing and conducting the management review.

Frequently asked questions

How many objectives do I need?

The standard does not specify a number. What matters is that the objectives are consistent with the information security policy, measurable and monitored. To start with, a few objectives are often enough, for example on training, incidents and open vulnerabilities.

Can I change an objective after the evaluation?

No. Define a new objective for the next period.

Who records the measured values?

The responsible person or people with the permission to manage objectives.