ISO 27001 clause 6.2 requires them at relevant functions and levels, consistent with the information security policy, measurable where practicable and kept as documented information. Examples are a target for patching critical vulnerabilities within a set time, or for completing access reviews every quarter.
Progress against them is an input to management review, and the monitoring in clause 9.1 is how the measurement is done.
Read more
Related terms
- Management review
- Management review is the recurring review in which top management assesses whether the management system is still suitable, adequate and effective.
- Information security management system
- An information security management system is the set of policies, processes and responsibilities an organization uses to manage information security risk.
- Interested parties
- Interested parties are the people and organizations whose requirements an ISMS must take into account: customers, regulators, staff, owners and suppliers.
- ISO 27001
- ISO/IEC 27001 is the international standard for an information security management system, certified by an accredited body on a three-year cycle.