ISO 27001/Chapter/5 Leadership

This chapter ensures that top management is directly involved in the ISMS, providing leadership, direction, and commitment. It contains three sub-clauses:

5.1 Leadership and commitment

Top management must demonstrate leadership by:

• Ensuring the ISMS objectives align with the organization’s strategic direction.
• Integrating ISMS requirements into business processes.
• Providing necessary resources.
• Promoting continual improvement.
• Supporting other roles in demonstrating leadership.

5.2 Information security policy

Management must establish an information security policy that:

• Is appropriate to the organization’s purpose.
• Provides a framework for setting ISMS objectives.
• Includes a commitment to satisfy requirements and continually improve the ISMS.
• Is documented, communicated, and made available to relevant stakeholders. (MANDATORY!)

5.3 Organizational roles, responsibilities, and authorities

Top management must ensure roles relevant to information security are assigned and communicated.

Specific responsibility must be assigned for:

• Ensuring the ISMS conforms to ISO/IEC 27001.
• Reporting on ISMS performance to top management.