Objective 6: Ensure the security performance meets current and future requirements of the entity
The organization should know that its protection is fit for purpose, at an agreed level, and that performance is measured and maintained against current and future needs.
What clause 7.2.6 asks
The organization should know that its protection is fit for purpose and provides an agreed level of security. That level has to be stated, monitored and kept in step with what the entity needs now and will need later. The board should read performance in terms of its effect on the entity, not only in terms of how well individual controls run. Inside each management system, leadership should run a measurement programme that monitors, audits and finds improvements. The board should connect security results to how the organization and the entity are doing. The clause joins two conversations that often run apart: the control figures the security team uses and the business performance the board already follows.
Why it matters
An agreed level of security is the anchor. Without it, performance has no scale, and every report is a list of activities. The clause asks for the level to be agreed, which means the board and management have said what adequate looks like for this entity. It then asks for the measurement to say something about the entity, not only about the controls. A patch compliance figure can be useful to the operations team and meaningless to a board that wants to know whether a disruption would stop a critical service. The bridge is the impact reading: which entity objectives depend on the information, and what would happen if the protection failed. That reading also makes the future part possible, because it shows where the dependency is growing.
What good looks like
Agree the level of security in a short statement the board has approved, with the services and information it covers. Build the measurement programme around three layers: control health for the operators, service impact for the executives, and entity dependency for the board. Test each measure by asking what decision it would change. Report the trend, not only the point. Review the future requirements once a year against the strategy and the acquisition pipeline, and adjust the level when the dependency changes.
Evidence a board or an auditor asks for
The agreed level of security with board approval; the measurement programme with the three layers; a board report that reads performance in entity terms; the annual future requirements review.
- Record The agreed level of security with board approval
- Record the measurement programme with the three layers
- Record a board report that reads performance in entity terms
- Record the annual future requirements review
Where it commonly fails
- Board reporting of control metrics with no entity impact reading
- No agreed level of security to measure against
- A measurement programme that never changes a decision
What to do before publication
Before the edition 3 text is published, put clause 7.2.6 on the entity governance and the objectives agenda, name the owner of each line above and give it a review date. When the final draft or the published text is available, compare it with this record and note every difference.
Read across
- 7.1 Overview
- 7.2.1 Objective 1: Establish integrated, comprehensive, entity-wide information security
- 7.3.4 Monitor
- 8.1 Organization and ISMS
← 7.2.5 Objective 5: Foster a security-positive culture7.3.1 General →