6.2Information security objectives and planning to achieve them

The organization shall establish information security objectives at relevant functions and levels.

The information security objectives shall:

a) be consistent with the information security policy;

b) be measurable (if practicable);

c) take into account applicable information security requirements, and results from risk assessment

and risk treatment;

d) be monitored;

e) be communicated;

f) be updated as appropriate;

g) be available as documented information