{ "schemaVersion": "artifactDefinition.v2", "definitionId": "ISO.artifactDefinition.v2", "artifactId": "ISO", "title": "Information Security Objectives", "artifactType": "Register", "format": "xlsx", "productTier": "Basic", "definitionRole": "contract", "sourceModel": { "body": "canonical human-readable register maintained in the Artifact Candidate page", "jsonDefinition": "machine-readable contract and validation model", "jsonExample": "curated realistic example data fixture" }, "purpose": "Define the required structure for measurable information security objectives aligned with the information security policy, including owners, targets, measures, status, review cadence and evidence.", "sections": [ { "order": 1, "id": "title_page", "title": "Title Page", "contentType": "metadata", "required": true, "hint": null }, { "order": 2, "id": "abstract", "title": "Abstract", "contentType": "narrative", "required": true, "hint": { "text": "Use ISO to turn security intent into measurable objectives that management can review.", "bookReference": "Volume 1, S-02-01-00 Information Security Policies & Risk" } }, { "order": 3, "id": "document_control", "title": "Document Control", "contentType": "control_table", "required": true, "hint": null }, { "order": 4, "id": "instructions", "title": "Instructions", "contentType": "ordered_list", "required": true, "hint": { "text": "Objectives should be measurable, assigned, monitored and aligned with policy, risk and management review.", "bookReference": "Volume 1, S-02-01-00 Information Security Policies & Risk" }, "intro": "Complete the Working sheets using the example tabs as a model. Follow the workbook usage rules below." }, { "order": 5, "id": "information_security_objectives", "title": "Information security objectives", "contentType": "register_table", "required": true, "minimumExampleRows": 6, "columns": [ { "name": "Objective ID", "type": "text", "required": "yes", "description": "Unique objective identifier.", "example": "ISO-001" }, { "name": "Objective", "type": "text", "required": "yes", "description": "Objective statement.", "example": "Complete awareness training" }, { "name": "Policy Alignment", "type": "text", "required": "yes", "description": "Link to policy intent.", "example": "Awareness" }, { "name": "Metric", "type": "text", "required": "yes", "description": "Measurable metric.", "example": "Completion rate" }, { "name": "Target", "type": "text", "required": "yes", "description": "Target value.", "example": "\\>= 98%" }, { "name": "Current Value", "type": "text", "required": "yes", "description": "Current measured value.", "example": "96%" }, { "name": "Measurement Method", "type": "text", "required": "yes", "description": "Measurement method.", "example": "Monthly report" }, { "name": "Owner", "type": "select", "required": "yes", "description": "Accountable owner.", "example": "HR Manager", "valueSet": "domain.owner", "options": [ "ISMS Manager", "Control Owner", "Risk Owner", "Process Owner", "Asset Owner", "IT Security", "HR", "Legal", "Executive Management", "Internal Audit" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Review Frequency", "type": "text", "required": "yes", "description": "Review cadence.", "example": "Monthly" }, { "name": "Due Date", "type": "date", "required": "yes", "description": "Target or review date.", "example": "2026-09-30" }, { "name": "Status", "type": "select", "required": "yes", "description": "On track, in progress, at risk or achieved.", "example": "At risk", "valueSet": "domain.status.generic", "options": [ "Draft", "In Progress", "Under Review", "Approved", "Closed", "Deferred" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Evidence Reference", "type": "text", "required": "yes", "description": "Evidence record.", "example": "TR-2026-Q3" }, { "name": "Management Review Input", "type": "text", "required": "yes", "description": "Management-review relevance.", "example": "Pending acknowledgements" }, { "name": "Notes", "type": "text", "required": "no", "description": "Additional context.", "example": "Linked to exception." } ], "hint": { "text": "Each objective row should show the metric, target, current value, owner, review cadence and evidence source.", "bookReference": "Volume 1, S-02-01-00 Information Security Policies & Risk" } }, { "order": 6, "id": "objective_review_decision", "title": "Objective review decision", "contentType": "decision_table", "required": true, "fields": [ { "name": "Review result", "type": "select", "required": "yes", "valueSet": "domain.reviewResult", "options": [ "Pass", "Pass with observations", "Fail", "Deferred" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Objectives reviewed", "type": "text", "required": "yes" }, { "name": "Objectives on track", "type": "text", "required": "yes" }, { "name": "Objectives at risk", "type": "text", "required": "yes" }, { "name": "Actions opened", "type": "text", "required": "yes" }, { "name": "Reviewed by", "type": "text", "required": "yes" }, { "name": "Decision date", "type": "date", "required": "yes" }, { "name": "Evidence reference", "type": "text", "required": "yes" } ], "hint": { "text": "Close with a review decision so objective performance feeds management review and continual improvement.", "bookReference": "Volume 1, S-02-01-00 Information Security Policies & Risk" } }, { "order": 7, "id": "external_references", "title": "References", "contentType": "reference_table", "required": true } ], "validationRules": [ "JSON Example must contain definitionRef pointing to ISO.artifactDefinition.v2.", "JSON Example register sections must contain schemaRef pointing to the matching definition section.", "Objective rows must include measurable metric, target, current value, owner, review frequency, status and evidence reference.", "Body must render the contract schema and the example data.", "No standalone Book reference section and no generic Sample placeholders are allowed." ], "enrichment": { "source": "Contract.json", "method": "curated-json", "note": "Completes Contract JSON from MD-only schema/sections, removes duplicate alias sections, and normalizes string columns into structured column objects." }, "editorialStandard": { "isoAnchors": [ { "label": "ISO/IEC 27001:2022 6.2", "href": "https://www.iso.org/standard/82875.html", "role": "Normative source this artifact implements or cites." }, { "label": "ISO/IEC 27001:2022 7.5", "href": "https://www.iso.org/standard/82875.html", "role": "Documented information: identify, review and cite this workbook by version." } ], "bookSources": [ { "series": "ISO 27001 for Software Companies", "volume": 1, "volumeTitle": "Building the ISMS", "chapterId": "S-02-01-00", "chapterTitle": "Information Security Policies & Risk", "primary": true, "role": "Primary operating chapter for this companion artifact.", "href": "https://www.amazon.com/dp/9789908983448" }, { "series": "ISO 27001 for Software Companies", "volume": 1, "volumeTitle": "Building the ISMS", "chapterId": "S-00-03-00", "chapterTitle": "Planning, Risk & Objectives (Clause 6)", "primary": false, "role": "Documented information, review and version discipline.", "href": "https://www.amazon.com/dp/9789908983448" } ], "acronyms": [ { "abbr": "ISMS", "longForm": "Information Security Management System" }, { "abbr": "SaaS", "longForm": "Software as a Service" }, { "abbr": "CIA", "longForm": "Confidentiality, Integrity, and Availability" }, { "abbr": "CI/CD", "longForm": "Continuous Integration / Continuous Delivery" }, { "abbr": "CI", "longForm": "Continuous Integration" }, { "abbr": "CD", "longForm": "Continuous Delivery" }, { "abbr": "HR", "longForm": "Human Resources" }, { "abbr": "IL", "longForm": "Impact Level" }, { "abbr": "JSON", "longForm": "JavaScript Object Notation" }, { "abbr": "RTP", "longForm": "Risk Treatment Plan" }, { "abbr": "SLA", "longForm": "Service Level Agreement" }, { "abbr": "BCP", "longForm": "Business Continuity Plan" }, { "abbr": "BIA", "longForm": "Business Impact Analysis" }, { "abbr": "CSP", "longForm": "Cloud Service Provider" }, { "abbr": "ISP", "longForm": "Information Security Policy" }, { "abbr": "KMS", "longForm": "Key Management Service" }, { "abbr": "NC", "longForm": "Nonconformity" }, { "abbr": "PAM", "longForm": "Privileged Access Management" }, { "abbr": "RTO", "longForm": "Recovery Time Objective" }, { "abbr": "TLS", "longForm": "Transport Layer Security" } ], "must": [ "Keep one live row per record on Working sheets. Do not merge several cases into one row.", "Example sheets must contain realistic Arcfield rows for every required sheet. Empty required cells are not an example." ], "mustNot": [ "Do not invent live rows in the renderer. Example data lives in the Example JSON.", "Do not treat Ex example tabs as working sheets. Do not put live data on system sheets." ], "softwareCompanyAdaptations": [ "Use Arcfield as the worked example (cover variant A).", "Name SaaS, CI/CD, privileged access or supplier interfaces in example rows where they affect this register." ], "exampleWorkbook": { "workedExampleOrg": "Arcfield", "requiredSheets": [ "information_security_objectives", "objective_review_decision" ], "minExampleRows": 6, "coverFromExample": true } }, "editorialContractId": "editorial.xlsx.register.v1", "contentContractId": "content.register.items.v1" }