Revision as of 11:09, 19 June 2026 by Meryam Sahin (talk | contribs)
This chapter ensures that top management is directly involved in the ISMS, providing leadership, direction, and commitment. It contains three sub-clauses:
5.1 Leadership and commitment
Top management must demonstrate leadership by:
- Ensuring the ISMS objectives align with the organization’s strategic direction.
- Integrating ISMS requirements into business processes.
- Providing necessary resources.
- Promoting continual improvement.
- Supporting other roles in demonstrating leadership.
5.2 Information security policy
Management must establish an information security policy that:
- Is appropriate to the organization’s purpose.
- Provides a framework for setting ISMS objectives.
- Includes a commitment to satisfy requirements and continually improve the ISMS.
- Is documented, communicated, and made available to relevant stakeholders. (MANDATORY!)
5.3 Organizational roles, responsibilities, and authorities
Top management must ensure roles relevant to information security are assigned and communicated.
Specific responsibility must be assigned for:
- Ensuring the ISMS conforms to ISO/IEC 27001.
- Reporting on ISMS performance to top management.
