## Clause 6.2: Objectives and planning

[Clause 6.2](../../../MoCs/ISO_27001_2022_6.2_MoC%20Information%20security%20objectives%20and%20planning%20to%20achieve%20them.md) demands that organizations should have information security objectives. These may be derived from the risk assessment from 6.1, from commercial objectives, from legal and regulatory compliance, or based on some other ambition or necessity.

 The information security objectives the organization identifies shall:
 - be consistent with information security policy ([C5.1](../../../MoCs/ISO_27001_2022_5.1_MoC%20Leadership%20and%20commitment.md), [A5.1](../legacy/iso27DIY%20mk%20I/ISO_27002_2022_5.1_MoC%20Policies%20for%20information%20security.md))
 - results from the risk assessment ([6.1.2](../../../MoCs/ISO_27001_2022_6.1.2_MoC%20Information%20security%20risk%20assessment.md)) and risk treatment ([6.1.3e](../../../MoCs/ISO_27001_2022_6.1.3_MoC%20Information%20security%20risk%20treatment.md))
 - take into account applicable information security requirements ([4.2](../../../MoCs/ISO_27001_2022_4.2_MoC%20Understanding%20the%20needs%20and%20expectations%20of%20interested%20parties.md), needs and expectations of interested parties),
 - be measurable (if practicable, see below)

... and these objectives shall be communicated and updated the objectives 'as appropriate'.

So the objectives formulated will be based on an understanding of the organization and its context ([4.1](../../../MoCs/ISO_27001_2022_4.1_MoC%20Understanding%20the%20organization%20and%20its%20context.md)), an understanding of the needs and expectations of interested parties ([4.2](../../../MoCs/ISO_27001_2022_4.2_MoC%20Understanding%20the%20needs%20and%20expectations%20of%20interested%20parties.md)), an understanding of the risks ([6.1](../../../MoCs/ISO_27001_2022_6.1_MoC%20Actions%20to%20address%20risks%20and%20opportunities.md)), and the discussions we've had with our management.

Some security objectives might be very high level and long term, like ensuring ongoing legal and regulatory compliance, or short-term and much more measurable objectives, like improving incident response time.

The organization must also have clear plans to achieve these objectives, because the underlying purpose of having an ISMS is: to allow the organization to achieve its objectives.
