During the operation of the ISMS, what is a requirement for information security objectives?

ISO/IEC 27001:2022 requires information security objectives to be established at relevant functions and levels, to be consistent with the information security policy, to be measurable if practicable, and to be monitored, communicated, and updated as appropriate. It also requires documented information on the objectives. Among the answer choices, option C is the best single answer because it expresses one of the core mandatory characteristics of the objectives. Even though options B and D are also requirements, the question asks for one answer only, and option C is the most fundamental wording in the set.

=======