Management responsibilities

What the requirement asks

Managers are to insist that everyone working for the organization applies information security as the organization's policy, topic-specific policies and procedures lay down. Purpose: make sure managers grasp their own part in information security and act so that all staff know and carry out their security duties. Guidance: management shows visible backing for the policies, procedures and controls. Its duties include making sure people are briefed on their security role before they receive access to information and assets; are given written expectations for their role; are required to follow the policies; reach a level of awareness that matches their role (see 6.3); keep to the security terms of their employment contract or agreement and the expected ways of working; maintain the right security skills and qualifications through continuing education; have, where practical, a confidential route for reporting breaches of policy or procedure (whistleblowing), which may be anonymous or restrict knowledge of the reporter's identity to those handling the report; and are given enough resources and planning time to implement the security processes and controls. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

Management responsibilities include the duty to require staff to apply the controls. The guidance asks how that requirement is communicated and what happens when a manager ignores it.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep evidence that security briefings on roles and responsibilities occur before access is granted, such as onboarding checklists tied to access provisioning and one live sample together.

Evidence an assessor asks for

• Management commitmentEvidence that security briefings on roles and responsibilities occur before access is granted, such as onboarding checklists tied to access provisioning
• Management commitmentRole-specific guidance documents setting out security expectations
• Management commitmentSigned employment contracts or agreements containing the security obligations
• Management commitmentRecords of continuing professional education for staff in security-relevant roles
• Management commitmentA confidential or anonymous reporting channel for policy violations with its handling procedure
• Management commitmentProject plans or budgets showing resources and time allocated to security processes and controls

The question an assessor will ask

An assessor will ask for evidence that security briefings on roles and responsibilities occur before access is granted, such as onboarding checklists tied to access provisioning, then trace it to the system it protects. For A.5.4 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• Access is provisioned before any security briefing takes place
• No confidential route exists for reporting violations, or reporters' identities are not protected
• Managers do not visibly endorse the policies, so compliance is seen as the security team's concern
• Security work is expected without any allocated time or resource in project plans

Before the next audit

Before the next audit, check one live sample for this gap: access is provisioned before any security briefing takes place.