Leadership and commitment

Plain-language summary

What top management must personally do for the ISMS — set the direction, fund it, integrate it into how the business runs, make people accountable and keep asking whether it works — rather than delegate it to IT.

What the clause is really asking

Information security fails at the top more often than at the firewall, so the clause lists the specific things top management must do: ensure the policy and objectives exist and fit the strategic direction; ensure ISMS requirements are integrated into the organisation's processes rather than bolted on; make the resources available; communicate that information security matters and that conforming to the ISMS is expected; ensure the ISMS achieves its intended outcomes; direct and support people to contribute; promote continual improvement; and support other managers in showing leadership in their own areas. The word 'ensure' recurs — top management need not do the work, but must be able to show it caused the work to happen and checked the result. This is where POPIA's accountability condition and the board duties in King V and the FSCA/PA Joint Standard land: the governing body owns information and technology governance, and this clause is the ISMS's version of that duty.

What auditors look for

Auditors interview top management directly, without the ISMS lead in the room, and ask open questions: what are the biggest information risks to this business, what did you decide at the last management review, how do you know the ISMS is working, what happened after the last incident? They look at money and time — budget lines for security, training hours, whether the CEO attended the management review or sent apologies — and at integration: do project approvals, procurement and HR onboarding carry security steps, or does security find out afterwards? A policy signed by a director who cannot describe it is the most common failure.

Typical evidence

Signed information security policy and approved objectives; management-review minutes showing top-management attendance and decisions; budget and resource approvals for security; evidence security is built into business processes (project gates, procurement checklists, onboarding); internal communications from leadership about information security; delegated roles with authority (5.3).

How to comply — recommendations

Give top management three habits and record them: chair or attend the management review and make real decisions there; approve the risk acceptance criteria and the SoA, and see which residual risks the risk owners have accepted (6.1.3 gives that sign-off to the risk owners); and speak about information security to staff in their own words at least twice a year. Build security steps into the processes leadership already controls — capital approvals, new-supplier onboarding, new-hire induction — so integration is structural, not a reminder email. Brief the directors in one page per quarter: top risks, incidents, audit results, objectives. If a director could not answer the auditor's questions today, that is the gap to close first.

Common nonconformities

Top management cannot describe the ISMS, its risks or recent decisions; policy and objectives approved but not aligned with business strategy; no evidence of resources being made available; security not integrated into business processes (projects, procurement, HR); management review delegated entirely to IT with no leadership decisions recorded; other managers unaware of their security responsibilities.

Resources for this clause

• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Free downloadInformation Security Policy templateThe clause 5.2 policy on one page: what you commit to, the objectives framework, who does what, the rules in brief, communication and review — with «fields» to fill and a box on how to keep it true.
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.