Management responsibilities

Plain-language summary

Making every manager, not only top management, answerable for the people who report to them applying the information security policies and procedures in their daily work — and for supporting them with time, training, a clear route to report concerns and a good example.

What the clause is really asking

Clause 5.1 of ISO 27001 deals with top management's leadership of the ISMS. This control reaches further down the line: it makes managers answerable for their people following the security policies and procedures in practice. That means line managers making sure their team members are briefed on their security responsibilities before they get access, understand the policies that apply to their role, have the time and training to comply, follow the rules, and know how to report a concern or incident without fear of blame. Managers also set the example — a manager who shares passwords or forwards confidential files to personal email teaches the team that the policy is optional. The common misunderstanding is to treat this as a repeat of clause 5.1 and answer it with the CEO's signature on the policy. Auditors look for evidence at supervisor level. In South Africa this is the people side of the 'organisational measures' POPIA section 19 requires, and ISO 9001 practitioners will recognise the pattern of leadership exercised at every level, not only at the top.

What auditors look for

Auditors interview managers at several levels — a production supervisor, a finance manager, a sales lead — and ask what they do to make sure their team follows the security policies. They ask how a new starter is briefed before getting system access and who signs that off. They check whether security responsibilities appear in managers' own objectives or performance reviews. They look at how a manager dealt with a policy breach in their team and whether it went through the disciplinary process. They test the reporting route by asking staff whether they would report a mistake. The hard question: show me a manager acting on a security issue in their own area.

Typical evidence

Manager briefing or training records on security responsibilities; induction checklists signed by the line manager before access is granted; security objectives or KPIs in management performance reviews; team meeting or toolbox talk records covering security; records of managers handling breaches and reporting incidents; confidential concern-reporting channel; management communications reinforcing policy.

How to comply — recommendations

Write a short manager's guide to information security: what managers must do for starters, movers and leavers, how to brief their team, how to handle a breach and how to escalate. Add a line-manager sign-off to the induction checklist confirming the security briefing happened before access was granted. Include one security item in each manager's annual objectives — team completion of awareness training, timely access reviews, prompt leaver notifications. Put information security on team meeting or toolbox talk agendas a few times a year and keep the attendance record. Make sure the confidential concern-reporting channel is known and that managers respond to reports without blame.

Common nonconformities

Managers unaware of their security responsibilities; staff given access before any security briefing; no security expectations in management objectives; managers bypassing policy themselves, for example by sharing credentials; team breaches handled informally with no record or follow-up; staff unaware how to raise a security concern; evidence of management commitment limited to the CEO's signature on the policy.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.