Set security objectives for the relevant functions and levels; they must agree with the policy, be measurable where practicable, reflect applicable security requirements and the outcome of risk assessment and treatment, be made known and be revised as needed, and be kept as documented information; plans to meet them state the work to be done, the resources, the person responsible, the completion date and how results will be judged. Implementation points (general ISMS practice; the 27003 guidance text is not held): derive objectives from the policy, risk treatment and interested-party requirements, place them where people can act on them, and give each an indicator that 9.1 can track. Held link: the 27003 guidance on 5.1 names the objective measures and the 9.1 measurements as sources of status reports to top management.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.