Information security objectives should be Specific, Measurable, Achievable, Realistic and Timely (SMART). You define the objective and then define the measures that are the characteristics of the objective.