Objectives

Last checked on 29-09-2026

This is where you set objectives for your information security: what you want to achieve, how you measure it, what target you aim for and by when. You record progress with a date and a measured value.

Why this protects your organisation

Without a goal you cannot tell whether all the security work is paying off. A measurable objective, such as how many days it takes to patch critical vulnerabilities, shows whether you are moving forward and gives leadership something concrete to steer on. ISO 27001 asks in clause 6.2 for objectives that are measurable, have an owner and a timeframe, and are monitored.

Steps

Open Objectives in the Improve group and click New objective.
Describe the objective under What and how you measure it under How this is measured.
Fill in the target, deadline and status, choose an owner and optionally the supporting policy, then click Create.
On the objective's page, click Record progress under Progress updates and fill in the date and the measured value.
Set the status to On track, At risk, Achieved or Dropped as things change.

What you record

What: the objective in one sentence, for example "Close critical vulnerabilities quickly".
How this is measured: the measurement, such as the percentage of critical vulnerabilities patched within 30 days.
Target: where you want to get to, for example 95%.
Deadline: when the objective should be met.
Status: On track, At risk, Achieved or Dropped.
Owner: who keeps an eye on the objective.
Supporting policy: optionally, the policy document the objective belongs to, so you can see which policy it puts into practice.

Progress and overview

The list is sorted by deadline, so you see what is due first. You can filter by Status. Each measurement under Progress updates has a date, so you can follow the trend over time.

In the management review, Trustbird counts how many objectives there are, how many are achieved or at risk, and how many are past their deadline without a result.

If it does not work

The deadline is highlighted with Deadline was

The deadline has passed while the status is still On track or At risk. Set the status to Achieved or Dropped, or choose a new deadline if you are deliberately extending the objective.

I cannot change a progress update

Progress updates are a log: what you record stays as it was. If a measurement was wrong, record a new one with the correct value.

My document is missing from Supporting policy

You can only choose documents of the type Policy. Check the document's type under Documents.

I cannot create an objective

Owners and members can create and update objectives. An advisor needs edit rights for the Policies and documents module. Only an owner or member can delete an objective.

Screens this is about

Objectives