Specify Suitable Objectives
Description
The entity specifies objectives with sufficient clarity to enable identification and assessment of risks relating to the objectives.
⚠️ Risk Impact
Without explicit security objectives, every risk is theoretically important and practically ignored. Teams optimize for the metrics they're measured on; if security objectives aren't measured, they aren't pursued.
🔍 How EchelonGraph Detects This
EchelonGraph's Tier 1 Cloud Scanner automatically checks for this condition across all connected cloud accounts. Violations are flagged as high-severity findings with remediation guidance.
🔧 Remediation
Document 3-5 measurable security objectives per fiscal year. Examples: '% workloads with compliance score ≥80', 'mean time to remediate critical findings ≤7 days', '% workloads with MFA enforcement'. Brief board quarterly on progress.
💀 Real-World Attack Scenario
A retail company's 'security objectives' were 'maintain SOC 2 compliance' and 'reduce risk' — both unmeasurable. A SOC 2 audit-cycle review found the company had 31 critical findings open across 4 quarters with no improvement trend. Audit team flagged CC3.1 as a finding: 'objectives are not specified with sufficient clarity'. Remediation required 3 weeks of cross-functional work.
💰 Cost of Non-Compliance
Non-measurable objectives: cited in 38% of SOC 2 qualified opinions on CC3 (AICPA peer-review data). Companies with measurable security KPIs reduce critical-finding aging by 64% (Forrester 2024).
📋 Audit Questions
- 1.List the entity's security objectives for the current fiscal year. Are they measurable?
- 2.What is the current progress against each objective?
- 3.Who is accountable for each objective?
- 4.Show me the board's most recent briefing on objective progress.
⚡ Common Pitfalls
- ⛔Objectives stated as activities ('we will run quarterly access reviews') rather than outcomes ('% access reviews completed within SLA ≥95')
- ⛔Setting objectives at the start of the year and never refreshing as threat landscape or business priorities change
- ⛔Too many objectives — 17 KPIs equals zero focus
📈 Business Value
Measurable security objectives turn security from a cost center into a managed function with documented progress. Material in board reporting, board approval of security budget, and SOC 2 sustained-control evidence.
⏱️ Effort Estimate
8-12 hours quarterly for objective setting + measurement
EchelonGraph derives security KPI baselines from live control data; tracks objective progress and surfaces drift
🔗 Cross-Framework References
Automate SOC 2 CC3.1 compliance
EchelonGraph continuously monitors this control across all your cloud accounts.
Start Free →