#iso27001/2022/EN
## 6.2 Information security objectives and planning to achieve them

The organization shall establish information security objectives at relevant functions and levels.

The information security objectives shall:

a\) be consistent with the information security policy;

b\) be measurable (if practicable);

c\) take into account applicable information security requirements, and results from risk assessment and risk treatment;

d\) be monitored;

e\) be communicated;

f\) be updated as appropriate;

g\) be available as documented information.

The organization shall retain documented information on the information security objectives.

When planning how to achieve its information security objectives, the organization shall determine:

h\) what will be done;

i\) what resources will be required;

j\) who will be responsible;

k\) when it will be completed; and

l\) how the results will be evaluated.
