Information Security Objectives & Plan¶
Purpose. Sets Soon's information security objectives for the current period, the plan and resources to achieve them, and the risks and opportunities affecting the ISMS itself (ISO/IEC 27001 clauses 5.1, 6.1.1, 6.2, 7.1, 8.1).
1. Scope¶
The whole ISMS of Soon: the cloud WFM SaaS platform, its supporting services, and the small fully remote team operating them. Objectives are set for the current planning period and reviewed at least annually.
2. Plan¶
2.1 How objectives are set¶
Objectives must be consistent with the Information Security Policy (docs/05-leadership/isms5-informationsecuritypolicy.md), measurable where practicable, communicated to the team, and updated through the management review process. They are informed by risk assessment results, customer and regulatory (GDPR) requirements, and audit findings. Progress is tracked in the quarterly security review and formally evaluated at management review.
2.2 Objectives for the current period¶
| Ref | Objective | Measurement | Target | Timescale | Owner |
|---|---|---|---|---|---|
| 1 | Establish a complete, approved ISMS document set aligned with ISO/IEC 27001 | Percentage of documents in REGISTER.md at status approved |
100% of documents in the approval batch | Q4 2026 | Olaf Jacobson |
| 2 | All Annex A controls declared applicable in the SoA are implemented or have a treatment action | Percentage of applicable controls implemented | 100% implemented or with an owned treatment action | Q4 2026 | Olaf Jacobson |
| 3 | All High/Critical risks in the risk register treated to Medium or below, or formally accepted | Count of untreated High/Critical risks | 0 | Q4 2026 | Olaf Jacobson |
| 4 | All team members complete security awareness training | Percentage of team trained, per training records | 100% | Q4 2026, then annually | Olaf Jacobson |
| 5 | Achieve ISO/IEC 27001 certification | Certification audit passed | Certificate issued | Q1 2027 | Olaf Jacobson |
Objectives, targets and dates confirmed by the owner on 2026-08-13; to be endorsed by top management (the four founders) at the next management review. ISO certification targets Q1 2027, following SOC 2 Type 1 — ISO expects the ISMS to have been operating with evidence for roughly three months, plus an internal audit and a management review.
2.3 Plan to achieve the objectives¶
| Ref | Key tasks | Resources | Evaluation |
|---|---|---|---|
| 1 | Rewrite/draft remaining documents; review and approve via pull requests | Consultant time (Andrea Cardinali); owner review time (Olaf Jacobson) | REGISTER.md status; merged PRs |
| 2 | Implement controls per SoA; collect evidence pointers per document | Engineering time; AWS/GitHub configuration | Evidence entries verified at internal audit |
| 3 | Execute the Risk Treatment Plan (docs/06-planning/risk-treatment-plan.md) | Risk owners' time | Residual scores in risk register |
| 4 | Roll out training and record completion | /isms:onboard (built in-house, no external platform or budget) |
Training & Awareness Log (ISMS-DOC-07-5) |
| 5 | Internal audit, management review, then certification audit | Internal audit by Andrea Cardinali (CyberSquad); ISO certification body via Andrea's network — body selected after SOC 2 Type 1, budget set then (decided 2026-09-01) | Audit reports; certificate |
If a task looks unlikely to complete on time, the impact on its objective is raised at the quarterly security review and, where needed, escalated to top management to decide on additional resources or a revised target.
2.4 Resources¶
Soon is a small remote company; the enterprise role structure of the original template does not apply. Ongoing ISMS resources are:
- Security responsible — part of Olaf Jacobson's role: at least 4 hours a week. Across the whole team, ISMS and security work takes roughly 8–10 hours a week (owner, 2026-09-29).
- External consultant — Andrea Cardinali, drafting and facilitation. Scope and duration per ISMS-DOC-A05-20-1: drafting, facilitation, internal audit and certification-body sourcing, through the Q1 2027 certification audit.
- Team time — the quarterly security review, the annual awareness refresher, and control operation as part of normal engineering work.
- Technical resources — the existing stack (AWS, GitHub, Sentry, CloudWatch).
- Budget — €500 a month in total for security tooling, training and certification (owner, 2026-09-29). Larger one-off items, such as the ISO certification audit fee, are decided by top management when they arise.
2.5 Risks and opportunities for the ISMS itself¶
Risks to the effectiveness of the ISMS (managed via management review):
| Ref | Risk | Treatment approach |
|---|---|---|
| 1 | Resources not available for proactive security work in a small team | Objectives sized to team capacity; escalation at the quarterly security review |
| 2 | Team does not engage with the ISMS, weakening control implementation | Keep documents short and practical; awareness training (objective 4) |
| 3 | Management not sufficiently involved to sustain the ISMS after certification | Management review cadence; named internal owner (Olaf Jacobson) for approvals |
Opportunities:
| Ref | Opportunity | Action |
|---|---|---|
| 1 | Security incidents in the industry raise customer demand for assurance | Use certification (objective 5) in customer communication |
| 2 | The POST25 abuse incident (Feb–Mar 2025) exposed weak points in sign-up and invitations | Done 2025-03-21, still in place (verified in soon-server main, 2026-09-29): name validation on first, last and team names; disposable and blacklisted email domains rejected at team creation and email change (Sentinel, library plus the Blackmail table); a 500-member cap per team; the SES suppression list. Recorded retrospectively as INC-2025-01. The September 2026 pentest (#3) extends the lesson to every place user-supplied names leave the browser (S-610) |
3. Roles & responsibilities¶
- Top management — approves objectives and provides resources. Top management is the four founders/shareholders — Olaf Jacobson, Thomas Picauly, Melvin Jacobson, Alessandro Cardinali; policies are signed by Olaf Jacobson on their behalf with endorsement minuted (decided 2026-09-01).
- Security responsible (Olaf Jacobson) — owns most objectives, tracks progress, reports at management review.
- External consultant (Andrea Cardinali) — maintains this plan and prepares progress reporting.
- All team members — complete training and operate controls in their daily work.
4. Related documents¶
- docs/05-leadership/isms5-informationsecuritypolicy.md — Information Security Policy
- docs/06-planning/ISMS-DOC-06-2-risk-assessment-and-treatment-process.md — Risk Assessment and Treatment Process
- docs/06-planning/ISMS-FORM-06-2-statement-of-applicability.md — Statement of Applicability
- docs/09-performance/isms9-procedure-for-management-reviews.md — Management Review Procedure
Risk treatment detail formerly duplicated in this document now lives solely in docs/06-planning/risk-treatment-plan.md.
Change log¶
| Version | Date | Author | Comments |
|---|---|---|---|
| 0.1 | 2023-12-11 | First draft document | |
| 0.2 | 2026-07-18 | Andrea Cardinali | Rewritten lean and Soon-specific (ISMS overhaul) |
| 0.3 | 2026-09-29 | Olaf Jacobson | Owner answers: time allocation (ISM ≥4 h/week, team 8–10 h/week), budget (€500/month for tooling, training and certification), and POST25 status: the 2025 abuse incident's controls are implemented and still in production. |
| 0.4 | 2026-10-16 | Olaf Jacobson | Policies matched to practice (owner decisions 2026-10-16): progress tracked at the quarterly security review; training objective set to annual refresher (target Q4 2026). |