Requirements

Each goal contributes to the achievement of specific benefits ( strategic objectives ). The requirements, closely related with the organization's mission, vision, and values, in public sector will often be expressed in foundation legal acts , regulations or conceptual documents like government strategies .

Consistency

Consistent and clear design leads to transparency of the goals.

Process-design : Documented and well-structured process for setting and revising goals

Reference Related documents are referenced like: strategic plans , annual reports , and other goal-setting documents .

Retro-consistency : The goals are in harmony with goals of previous periods - significant changes of directions, if any, can be substantiated in a convincing way.

Levels consistency : All teams and entities taking part in an activity, project or programme, form goals which are consistent among themselves.

Goals and priorities ^SE2023

the ministries and government agencies proceed based on their respective goals and priorities . This makes it difficult to ensure that the implemented efforts are the appropriate ones for Sweden’s national information and cyber security, and that the efforts are carried out efficiently. (…) The Government’s control has therefore largely been based on separate issues that have not been valued or ranked on the basis of their benefits to Sweden as a whole.
Government control of national information and cyber security – both urgent and important RiR - Sweden 2023

Materiality

Each of the goals and all the goals together focus on material matters, i.e. all key challenges and opportunities, that are substantial to the organization's ability to create value over the short, medium, and long term. Materiality awareness is basis of prioritization of the goals set.

Timeline

It provides a schedule for when the goal needs to be implemented and can help in planning and resource allocation. Level of detail in the timeline can vary. It might specify a precise date, or it could be more general, such as a requirement to implement a feature within the next fiscal quarter. The timeline should be realistic and take into account the complexity of the requirement and the resources available.

Documentation

Supporting documentation and evidence related to the goal-setting process are preserved and available

Level of exposure ^AU2019

Australia Post also has a Risk Appetite Statement that states it supports: ‘a highly secure environment and will not tolerate data security incidents resulting in material theft, loss or corruption of business or confidential internal and customer data.’ (…) While Australia Post has identified its critical ICT assets, it has not documented the threats, risks and mitigations against all critical assets. Further work is required by Australia Post to validate the level of exposure and protection required across its critical assets.
Cyber Resilience of Government Business Enterprises and Corporate Commonwealth Entities ANAO - Australia 2019