Leadership and commitment
Top management has to show leadership of and commitment to the ISMS by: making sure the security policy and objectives exist and fit the organization's strategic direction; building ISMS requirements into business processes; making the....
What the requirement asks
Top management has to show leadership of and commitment to the ISMS by: making sure the security policy and objectives exist and fit the organization's strategic direction; building ISMS requirements into business processes; making the needed resources available; communicating why effective security management and conformity with ISMS requirements matter; making sure the ISMS achieves what it is meant to; directing and supporting people to contribute to its effectiveness; promoting continual improvement; and supporting other managers in showing leadership in their own areas. A note explains that business can be read broadly as the activities core to the organization's existence.
What the guidance adds
The guidance reads leadership through decisions. It looks for top management taking accountability for the system, integrating it into business processes, providing resources and directing the work at review points. A signed policy and a launch email are not enough if the same leaders approve conflicting priorities.
Status of the guidance. The guidance lens for 5.1 reads the draft, which is at stage 40.00 and is not published, against the published ISO/IEC 27001:2022 requirement above. It is our reading, not a quotation, and it is not a requirement.
What good looks like
Keep board or executive minutes approving the security policy and objectives and showing their alignment with strategy with the clause record, and give it an owner and a review date.
Evidence an assessor asks for
- Top management commitmentBoard or executive minutes approving the security policy and objectives and showing their alignment with strategy
- Top management commitmentBudget and resource approvals for the ISMS
- Top management commitmentCommunications from top management about the importance of information security
- Top management commitmentEvidence of ISMS requirements embedded in business processes, such as security steps in procurement or project approval
- Top management commitmentRecords of top management participation in management reviews and improvement decisions
The question an assessor will ask
An assessor will ask for board or executive minutes approving the security policy and objectives and showing their alignment with strategy. The test for 5.1 is whether that record can be produced for a live sample, not whether the clause is described in a procedure.
Common gaps
- Leadership is delegated entirely to the security manager
- Resource requests go unanswered and no allocation is recorded
- Top management never communicates about information security
- Objectives are not linked to the business strategy
Before the next audit
Before the next audit, test this against one live record: leadership is delegated entirely to the security manager.