ISO 27001 Leadership and Commitment
ISO 27001 is a top down management system that needs leadership to be engaged and driving information security.
Getting this right is important. Without the leadership and the commitment the information security management system will fail. Think about why you are doing it and check that the management agrees. If they do not, or they see it has a burden then you are doomed to fail from the offset. It can be just a tick box exercise, to succeed, it really really should not be.
Table of contents
What is ISO 27001 Clause 5.1?
ISO 27001 Clause 5.1 is Leadership and Commitment. It requires you to to make sure you have the support and buy in of your leadership team for your information security management system (ISMS).
Leadership and commitment is about having an information security management system (ISMS) that is driven and led from the top.
Without this level of commitment and drive the information security management is doomed to fail.
Giving this to IT to solve or devolving it to the lower ranks will see people not doing what they should do due to conflicting priorities.
As a top down leadership led standard, for ISO 27001 you are going to make sure that top management can demonstrate leadership and commitment with respect to the information security management system.
That leadership and commitment will:
- Ensure the information security policy and the information security objectives are established and are compatible with the strategic direction of the organisation.
- Ensure the integration of the information security management system requirements into the organisational processes.
- Ensure that the resources needed for the information security management system are available.
- Communicate the importance of effective Information Security Management and of conforming to the information security management system requirements.
- Ensure that the information security management system achieves its intended outcomes.
- Direct and support persons to contribute to the effectiveness of the information security management system.
- Promote continual improvement
- Support other relevant management roles to demonstrate their leadership as it applies to their role and information security.
ISO 27001 Clause 5.1 Purpose
The purpose of ISO 27001 Clause 5.1 Leadership and Commitment is to make sure that information security is driven from the top.
ISO 27001 Clause 5.1 Definition
The ISO 27001 standard defines ISO 27001 Clause 5.1 as:
Top management shall demonstrate leadership and commitment with respect to the information security management system by:
ISO27001:2022 Clause 5.1 Leadership and Commitment
a) ensuring the information security policy and the information security objectives are established and are compatible with the strategic direction of the organisation;
b) ensuring the integration of the information security management system requirements into the organisation’s processes;
c) ensuring that the resources needed for the information security management system are available;
d) communicating the importance of effective information security management and of conforming to the information security management system requirements;
e) ensuring that the information security management system achieves its intended outcome(s);
f) directing and supporting persons to contribute to the effectiveness of the information security
g) promoting continual improvement
h) supporting other relevant management roles to demonstrate their leadership as it applies to their
ISO 27001 Clause 5.1 Requirement
There are 8 specific requirements when it comes to leadership and commitment. This is a testament to how importantly the standard takes it. Read the implementation guide below to see exactly what they are how to quickly and simply meet the requirements.
DO IT YOURSELF ISO27001
STOP SPANKING £10,000s on CONSULTANTS and ISMS ONLINE PLATFORMS
How to implement ISO 27001 Clause 5.1
ISO 27001 is a top down leadership standard. It’s actually aligned with the majority of the ISO standards. They all follow a very similar format and if you’ve implemented other ISO standards such as ISO 9001 then a lot of what you will see here is going to be familiar to you. It may well be that you’re going to reuse what you have or just do a slight tweak.
You have to show and have to lead from the top. This isn’t driven by someone in IT. This isn’t driven by some information security person like me with their police hat on or their parent hat on telling you what it is that you need to do.
This has to be driven from leadership. It has to be driven from the top.
Time needed: 1 hour and 30 minutes
How to implement ISO 27001 Clause 5.1 is Leadership and Commitment
- Put in place a management review team
Working out who your information security leadership team is will be straightforward and you will implement a Management Review Team that will be responsible for the oversight of the information security management system (ISMS). The best way to work out who attends this is to have a senior representative from each department in the business plus ( if not already covered ) and member of the senior leadership team.
- Assign someone to own ISO 27001
To lead the work you really should consider bringing in some specialist help. The knowledge and experience of someone how has done this many times before will pay dividends and stop you making costly mistakes and wasting a lot of time. If that is not an option for you then getting members of your team trained in ISO 27001 lead implementor or ISO 27001 lead auditor may be a viable option. These courses come with a word of caution though as they are mainly booked based and generic in nature. They do not share the real world trials and tribulations of how you actually implement in your organisation. Which ever route you go, having a resource to lead the implementation and certification is a requirement.
- Write your information security policies
Write your information security policy and your associated topic specific information security policies based on the needs of the business and the risks the business faces. These are defined as part of the process of building your information security management system (ISMS).
- Write your information security objectives
Ensure that your information security objectives are Specific, Measurable, Achievable, Realistic and Timely (SMART) and for each objective clearly set out what the measures are. The information security objectives are recorded and communicated in the Information Security Policy and they are included as part of the structured agenda at the Management Review Team meeting for reporting and oversight.
- Agree and sign off the policies and objectives
The senior leadership team agree and sign off the policies and objectives.
- Implement an information security management system (ISMS)
The first resource you need is the information security management system. This is the ISO 27001 toolkit. The success of your ISO 27001 implementation and your ISO 27001 certification will hang on having the right resources available, allocated and engaged.
- Integrate the information security management system requirements into the organisational processes
Ensure the integration of the information security management system requirements into the organisational processes. The concept of ‘if it is not written down it does not exist’ plays through ISO 27001 certification. The organisation processes are going to need writing down and formatting in documents with appropriate documentation mark-up and version control. Stating what we do and not what we think auditors want to hear is key here as we will be audited against what we say we do. If we don’t do what we say we do we will fail.
You will document your processes simply and you will pay attention to having at least one exception step. An exception step caters for the ‘what if’ scenario that the process does not work or go to plan. What if the change fails? What if the software update fails? What if the virus is not quarantined? You get the idea. Auditors will always seek this out and ask. It is a common audit failure where it has not been considered and documented.
Satisfy this by having information security policies in place and then write and align your actual processes to those policies. Don’t forget to document the processes of the in scope products and services. Policies are statements of what we do not how we do it. How we do it is covered in these process documents. The process steps recorded are very specific so that anyone, even someone who has never worked in this area before, can follow them and achieve the same and consistent result. - Ensure resources are available
Understand the ISO 27001 standard and the ISO 27001 Annex A controls (referred to as ISO 27002) and allocate members of your team to those controls. You do this by recording them in an ISMS Annex A Controls – Accountability Matrix which assigns responsibility for each ISO 27001 Annex A Control.
It is ok that the work is carried out by a third party company but you must still assign internal responsibility for managing it and ensuring it gets done. There are a number of recommended documents to demonstrate this. There is the roles and responsibilities document that sets out all the roles and responsibilities and it states what those responsibilities are. You just allocate people to it. - Communicate on information security
You are going to communicate the importance of an effective information security management system and of conforming to the manage system requirements. There are a number of different ways that to demonstrate that from a leadership point of view.
For a detailed run through read ISO 27001 Clause 7.4 Communication
Communication is expected at all levels, across all medium and has some very specific requirements. It can easily be implemented and evidenced.
It can take many forms. For example it will be part of any legal contracts that you have with suppliers and with clients as well as employees.
You will implement an Information Security Awareness and Training Policy that sets out the training and awareness for the company as well as deploying training tools that allow you to schedule your communications and include acknowledgement of understanding such as tests or quizzes that you can use to evidence your compliance. You will plan your training based on business need and business risk but you will do Basic Information Security Awareness Training and Basic Data Protection Training at least annually. You may tailor your training and communication to specific groups and sub groups based on their specific needs.
You will implement a Communication Plan that sets out the communications for the year across media and approaches. It will be a record and a plan of what was communicated, who communicated it, to whom they communicated it, what they communicated and how they communicated it and it will include the evidence the communication took place.
There may be other processes that involve communication that you will evidence. Here we think about off boarding an employee when they leave or due to termination where we want to communicate again their requirements under contract for information security and the expectations that we place on them. - Direct and support people
You will direct and support people to contribute to the effectiveness of the management system via
1. Policies
2. Training
3. Communication
4. Competency Management and Competency Matrix
We want people to contribute effectively and the way we do that is via communicating and supporting them. If we don’t tell people what is expected we can not expect them to do it. You will have employment contracts and third party contracts that include coverage of information security requirements.
You will have a Competency Matrix that captures the core competencies and training requirements of staff in relation to information security.
Your Information Security Awareness and Training Policy sets out the training and awareness and your training tool and package is used to manage the process and the compliance.
The Communication Plan sets out the communications for the year across media and approaches as discussed above. - Promote continual improvement
As discussed continual improvement is baked in and a core principle. This is not a one and done. The external audits will happen every year as will your ongoing internal audits. Incidents will happen that need managing. Deviations from policy and procedure will happen. New ways of working and new tools will be identified.
Your Continual Improvement Policy sets out the continual improvement policy and the Incident and Corrective Action Log captures and manages the corrective actions and improvements.
The Communication Plan sets out the communications for the year across media and approaches and your management review team oversees the entire continual improvement process.
Implement continual improvement – further reading – ISO 27001 Clause 10.1 Continual Improvement - Support management roles
Support other relevant management roles to demonstrate their leadership as it applies to their areas of responsibility.
Examples of how to support other management roles include:
competency matrix
training plans
communication plans
management review meeting
top-down communication
Implementation Summary
You are starting to see a pattern that a small set of documents meets a lot of requirements. This because they have been intentionally written this way to provide the most efficient ISO 27001 implementation approach. The entire ISO 27001 toolkit is streamlined for efficient. For this sub clause the Information Security Roles Assigned and Responsibilities sets out the roles and responsibilities with allocated resource. A Management Review Team should be put in place with representatives from across the business. The Competency Matrix captures the core competencies and training requirements of staff in relation to information security. The Communication Plan sets out the communications for the year across media and approaches.
ISO 27001 Clause 5.1 Implementation Checklist
Leadership and Commitment ISO 27001 Clause 5.1 Implementation Checklist
1. Establish Information Security Policy
Top management shall establish an information security policy that is appropriate to the purpose of the organization.
Challenge: Creating a policy that is generic and doesn’t reflect the organisation’s specific context.
Solution: Involve key stakeholders in the policy development process. Tailor the policy to the organisation’s risk appetite and business objectives. Make it concise and easy to understand.
2. Communicate the Importance of Information Security
Top management shall ensure that the importance of information security is communicated within the organization.
Challenge: Employees not understanding the relevance of information security to their work.
Solution: Use various communication channels (e.g., emails, intranet, meetings) to reinforce the importance of information security. Provide real-world examples of the impact of security breaches. Make it personal and relevant.
3. Define Roles, Responsibilities, and Authorities
Top management shall assign roles, responsibilities, and authorities for information security.
Challenge: Overlapping or unclear responsibilities.
Solution: Create a RACI matrix (Responsible, Accountable, Consulted, Informed) to clearly define roles and responsibilities. Ensure that individuals have the necessary authority to carry out their assigned tasks.
4. Provide Resources for the ISMS
Top management shall determine and provide the resources needed for the ISMS.
Challenge: Budget constraints or lack of understanding of the resources required.
Solution: Conduct a thorough resource assessment. Justify resource requests based on risk assessments and business impact analysis. Demonstrate the ROI of investing in information security.
5. Promote a Culture of Information Security
Top management shall promote a culture of information security awareness and continual improvement.
Challenge: Resistance to change or a lack of awareness among employees.
Solution: Implement regular awareness training programs. Foster open communication about security issues. Recognise and reward good security practices. Lead by example.
6.Ensure the ISMS Achieves its Intended Outcomes
Top management shall ensure that the ISMS is achieving its intended outcomes.
Challenge: Difficulty in measuring the effectiveness of the ISMS.
Solution: Establish clear metrics and KPIs to track the performance of the ISMS. Regularly review the metrics and take corrective action when necessary.
7. Direct and Support Personnel
Top management shall direct and support personnel to contribute to the effectiveness of the ISMS.
Challenge: Lack of motivation or engagement from employees.
Solution: Provide regular feedback and coaching. Involve employees in the ISMS improvement process. Recognise and reward contributions to information security.
8. Engage Stakeholders
Top management shall engage interested parties relevant to the ISMS.
Challenge: Difficulty in identifying and engaging all relevant stakeholders.
Solution: Conduct a stakeholder analysis to identify key stakeholders and their needs. Establish communication channels with stakeholders. Seek feedback from stakeholders on the ISMS.
9. Support Continual Improvement
Top management shall support continual improvement of the ISMS.
Challenge: Resistance to change or lack of resources for improvement initiatives.
Solution: Foster a culture of continuous improvement. Prioritise improvement initiatives based on risk and business impact. Allocate resources for improvement projects.
10. Maintain the Integrity of the ISMS
Top management shall ensure that the integrity of the ISMS is maintained when changes are planned and implemented.
Challenge: Changes to the business or technology impacting the ISMS in unforeseen ways.
Solution: Implement a robust change management process that includes security considerations. Assess the impact of changes on the ISMS before they are implemented. Update the ISMS documentation as needed.
ISO 27001 Clause 5.1 Audit Checklist
How to audit ISO 27001 Clause 5.1 Leadership and Commitment:
1. Review the Information Security Policy
Verify that the policy is documented, approved by top management, and relevant to the organisation’s purpose. Check if it addresses key principles like confidentiality, integrity, and availability.
Audit Technique: Document review, interviews with top management.
2. Assess Communication of Importance
Evaluate how top management communicates the importance of information security throughout the organization. Look for evidence of communication through various channels.
Audit Technique: Interviews with employees at different levels, review of communication materials (e.g., emails, intranet posts).
3. Verify Roles and Responsibilities
Check if information security roles, responsibilities, and authorities are clearly defined and assigned. Look for documented roles and responsibilities (e.g., RACI matrix).
Audit Technique: Document review, interviews with individuals in key roles.
4. Examine Resource Allocation
Verify that top management has provided adequate resources (financial, human, technological) to support the ISMS. Review budget allocations and resource plans.
Audit Technique: Review of budget documents, interviews with top management and resource managers.
5. Evaluate Culture Promotion
Assess how top management promotes a culture of information security awareness and continual improvement. Look for evidence of training programs, awareness campaigns, and feedback mechanisms.
Audit Technique: Interviews with employees, review of training records and awareness materials.
6. Check Achievement of Intended Outcomes
Verify that the ISMS is achieving its intended outcomes. Review performance metrics, audit reports, and management review minutes.
Audit Technique: Review of performance data, interviews with process owners.
7. Assess Direction and Support of Personnel
Determine how top management directs and supports personnel to contribute to the effectiveness of the ISMS. Look for evidence of performance reviews, feedback mechanisms, and training opportunities.
Audit Technique: Interviews with employees and managers, review of performance records.
8. Verify Stakeholder Engagement
Check if top management engages interested parties relevant to the ISMS. Look for evidence of communication with stakeholders and consideration of their needs and expectations.
Audit Technique: Review of communication records, interviews with stakeholders.
9. Evaluate Support for Continual Improvement
Assess how top management supports continual improvement of the ISMS. Look for evidence of management review, identification of improvement opportunities, and allocation of resources for improvement projects.
Audit Technique: Review of management review minutes, improvement plans, and project documentation.
10. Confirm Maintenance of ISMS Integrity
Verify that top management ensures the integrity of the ISMS is maintained when changes are planned and implemented. Look for evidence of change management processes that include security considerations.
Audit Technique: Review of change management records, interviews with change managers.
What the auditor will check
The audit is going to check a number of areas for compliance with ISO 27001 Clause 5.1 Leadership and Commitment. Lets go through them
1. An interview with senior leadership
Part of the audit process will be a series of interviews and at least one will be with senior leadership. Here they will ask questions about the information security management system. They will ask about the objectives for information security, when they last did a management review, where the policies are, if there are incidents in the last 12 months. This is a general interview but will catch you out if your senior leadership is not actually involved.
2. Your documentation
It is simple but they will check the required documents and processes of the information security management system (ISMS) that relate to leadership and commitment. This usually means the communication plan and communications sent, that management reviews have happened and you can evidence them. That all document and processes have been signed off and communicated. Work through the implementation guide above and be sure to complete it.
3. That you have resources
Part of leading and showing commitment is to have adequate resources in place to run the ISMS. Here they are looking at roles and responsibilities, the competency matrix, the training plan. Are people allocated to roles and do they have the skills to perform the tasks.
ISO 27001 Clause 5.1 Common Mistakes
In my experience, the top 3 mistakes people make for ISO 27001 Clause 5.1 Leadership and Commitment are
1. Leadership are not engaged
It is easy to document roles and responsibilities and say leadership is engaged and committed but it is another thing for it to actually happen. If they pay lip service, come the audit and the interviews you will get caught out. Putting aside not having commitment means it is highly likely your ISMS isn’t actually effective and if you are responsible for it you are going to spend most of your career there frustrated.
2. You cannot evidence management reviews
The guides and toolkit give you the resources to address this but many organisations just don’t do reviews. Or when they do the wrong people attend making it ineffective. Be able to evidence management reviews that follow the structured agenda of the standard.
3. Your document and version control is wrong
Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.
Watch the Video
For a complete visual guide to this process, check out our video tutorial: How to implement ISO 27001 Clause 5.1 Leadership and Commitment
ISO 27001 Clause 5.1 FAQ
There are no changes to ISO 27001 Clause 5.1 Leadership and Commitment in the 2022 update.
Responsibility for ISO 27001 Clause 5.1 Leadership and Commitment lies with the Information Security Manager.
Accountability for ISO 27001 Clause 5.1 Leadership and Commitment lies with senior management and leadership.
Ownership of ISO 27001 Clause 5.1 Leadership and Commitment lies with the Information Security Manager.
Improved security: You will have an effective information security management system that is led by senior leadership and their commitment
Reduced risk: You will reduce the risk to your information security management system by having the most senior leadership on board
Improved compliance: Standards and regulations require leadership commitment to be in place
Reputation Protection: In the event of a breach having leadership commitment will reduce the potential for fines and reduce the PR impact of an event
ISO 27001 Clause 5.1 Leadership and Commitment is important because without it your information security management system will fail and you won’t achieve your ISO 27001 certification. It is a simple as that.
