5.1 Leadership and commitment
Top management shows commitment: aligning security with strategy, providing resources, communicating its importance and supporting others.
What auditors look for
Interviews with leaders who understand the ISMS; resources actually provided.
Typical evidence
Management review minutes, budget approvals, communications from leadership.
Playbook
5.1 Leadership and commitmentEvidence you need to provide
- Your security policy and objectives, approved by top management.
- Management review minutes showing leaders took part and made decisions.
- Proof management provided resources, such as budget or staffing approvals.
- Messages from leadership to staff about security.
- Top management should be able to explain why security matters and their role in it.
Policies & documents
- Information Security Policy (ISMS policy)
- ISMS roles, responsibilities and authorities document
- Information Security Policy
View full guide: 5.1 Leadership and commitment
5.2 Policy
Leadership sets an information security policy that suits the organisation, includes objectives (or a framework for them), and commits to meeting requirements and improving.
What auditors look for
An approved, communicated policy that staff know about.
Typical evidence
Signed information security policy, evidence of communication.
Playbook
5.2 PolicyEvidence you need to provide
- Your information security policy, including a commitment to meet requirements and keep improving.
- Proof the policy was approved and dated by management.
- Proof it was shared with staff and made available to interested parties where appropriate.
- Staff should be able to say where the policy is and what it means for them.
Policies & documents
Information Security Policy and topic-specific policies
View full guide: 5.2 Policy
5.3 Organizational roles, responsibilities and authorities
Assign and communicate who is responsible for the ISMS and for reporting on its performance.
What auditors look for
Named owners who know their roles.
Typical evidence
Roles & responsibilities document, org chart, RACI.
Playbook
5.3 Organizational roles, responsibilities and authoritiesEvidence you need to provide
- A document listing security roles and responsibilities, including who runs the programme and who reports to top management.
- An organization chart with security roles filled.
- Appointment letters or meeting notes assigning roles.
- People in these roles should be able to explain their duties.
Policies & documents
ISMS roles, responsibilities and authorities document
View full guide: 5.3 Organizational roles, responsibilities and authorities
