I disagree however, if you think it would be helpful you might have a far more distinct goal and set a timescale on it. Potentially This might be an aim that is one area about range of incidents to be below X by December 2024. Roles and Tasks (portion three) The area on roles and responsibilities is not really essential for ISO27001 but I recommend