Information Security Objectives & Plan¶
Purpose. Sets Soon's information security objectives for the current period, the plan and resources to achieve them, and the risks and opportunities affecting the ISMS itself (ISO/IEC 27001 clauses 5.1, 6.1.1, 6.2, 7.1, 8.1).
1. Scope¶
The whole ISMS of Soon: the cloud WFM SaaS platform, its supporting services, and the small fully remote team operating them. Objectives are set for the current planning period and reviewed at least annually.
2. Plan¶
2.1 How objectives are set¶
Objectives must be consistent with the Information Security Policy (docs/05-leadership/isms5-informationsecuritypolicy.md), measurable where practicable, communicated to the team, and updated through the management review process. They are informed by risk assessment results, customer and regulatory (GDPR) requirements, and audit findings. Progress is tracked in the weekly ISMS meeting (Thursdays 13:00 CEST) and formally evaluated at management review.
2.2 Objectives for the current period¶
| Ref | Objective | Measurement | Target | Timescale | Owner |
|---|---|---|---|---|---|
| 1 | Establish a complete, approved ISMS document set aligned with ISO/IEC 27001 | Percentage of documents in REGISTER.md at status approved |
100% of documents in the approval batch | Q4 2026 | Olaf Jacobson |
| 2 | All Annex A controls declared applicable in the SoA are implemented or have a treatment action | Percentage of applicable controls implemented | 100% implemented or with an owned treatment action | Q4 2026 | Olaf Jacobson |
| 3 | All High/Critical risks in the risk register treated to Medium or below, or formally accepted | Count of untreated High/Critical risks | 0 | Q4 2026 | Olaf Jacobson |
| 4 | All team members complete security awareness training | Percentage of team trained, per training records | 100% | Q3 2026, then quarterly | Olaf Jacobson |
| 5 | Achieve ISO/IEC 27001 certification | Certification audit passed | Certificate issued | Q1 2027 | Olaf Jacobson |
Objectives, targets and dates confirmed by the owner on 2026-08-13; to be endorsed by top management (the four founders) at the next management review. ISO certification targets Q1 2027, following SOC 2 Type 1 — ISO expects the ISMS to have been operating with evidence for roughly three months, plus an internal audit and a management review.
2.3 Plan to achieve the objectives¶
| Ref | Key tasks | Resources | Evaluation |
|---|---|---|---|
| 1 | Rewrite/draft remaining documents; review and approve via pull requests | Consultant time (Andrea Cardinali); owner review time (Olaf Jacobson) | REGISTER.md status; merged PRs |
| 2 | Implement controls per SoA; collect evidence pointers per document | Engineering time; AWS/GitHub configuration | Evidence entries verified at internal audit |
| 3 | Execute the Risk Treatment Plan (docs/06-planning/risk-treatment-plan.md) | Risk owners' time | Residual scores in risk register |
| 4 | Roll out training and record completion | /isms:onboard (built in-house, no external platform or budget) |
Training & Awareness Log (ISMS-DOC-07-5) |
| 5 | Internal audit, management review, then certification audit | Internal audit by Andrea Cardinali (CyberSquad); ISO certification body via Andrea's network — TODO(owner): confirm body and budget |
Audit reports; certificate |
If a task looks unlikely to complete on time, the impact on its objective is raised at the weekly ISMS meeting and, where needed, escalated to top management to decide on additional resources or a revised target.
2.4 Resources¶
Soon is a small remote company; the enterprise role structure of the original template does not apply. Ongoing ISMS resources are:
- Security responsible — part of Olaf Jacobson's role.
TODO(owner): estimate time allocation. - External consultant — Andrea Cardinali, drafting and facilitation.
TODO(owner): confirm engagement scope/duration. - Team time — weekly ISMS meeting attendance, awareness training, and control operation as part of normal engineering work.
- Technical resources — the existing stack (AWS, GitHub, Sentry,
CloudWatch); no dedicated security tooling budget is currently defined.
TODO(owner): confirm any budget for tooling, training and certification.
2.5 Risks and opportunities for the ISMS itself¶
Risks to the effectiveness of the ISMS (managed via management review):
| Ref | Risk | Treatment approach |
|---|---|---|
| 1 | Resources not available for proactive security work in a small team | Objectives sized to team capacity; escalation at weekly ISMS meeting |
| 2 | Team does not engage with the ISMS, weakening control implementation | Keep documents short and practical; awareness training (objective 4) |
| 3 | Management not sufficiently involved to sustain the ISMS after certification | Management review cadence; named internal owner (Olaf Jacobson) for approvals |
Opportunities:
| Ref | Opportunity | Action |
|---|---|---|
| 1 | Security incidents in the industry raise customer demand for assurance | Use certification (objective 5) in customer communication |
| 2 | The POST25 app-misuse event identified weak points in the app | Translate POST25 findings into controls and risk register entries — TODO(owner): confirm status of POST25 follow-up |
3. Roles & responsibilities¶
- Top management — approves objectives and provides resources.
TODO(owner): confirm who constitutes top management at Soon. - Security responsible (Olaf Jacobson) — owns most objectives, tracks progress, reports at management review.
- External consultant (Andrea Cardinali) — maintains this plan and prepares progress reporting.
- All team members — complete training and operate controls in their daily work.
4. Related documents¶
- docs/05-leadership/isms5-informationsecuritypolicy.md — Information Security Policy
- docs/06-planning/ISMS-DOC-06-2-risk-assessment-and-treatment-process.md — Risk Assessment and Treatment Process
- docs/06-planning/ISMS-FORM-06-2-statement-of-applicability.md — Statement of Applicability
- docs/09-performance/isms9-procedure-for-management-reviews.md — Management Review Procedure
Risk treatment detail formerly duplicated in this document now lives solely in docs/06-planning/risk-treatment-plan.md.
Change log¶
| Version | Date | Author | Comments |
|---|---|---|---|
| 0.1 | 2023-12-11 | First draft document | |
| 0.2 | 2026-07-18 | Andrea Cardinali | Rewritten lean and Soon-specific (ISMS overhaul) |