ISO 27001 clauses
Clause 5 is the part of the standard your ISMS manager cannot do for the CEO.
Clause 5 puts duties on top management by name: the people who direct the organisation, or the part of it in scope. An auditor will interview them, read their decisions and look for money and time they committed. A strong ISMS manager helps, but cannot stand in for them.
Back to ISO 27001 services01 · What leaders show
What top management has to be able to show
Clause 5.1 is about direction and support, not technical knowledge.
- Direction that fits the businessThe security policy and objectives point the same way as company strategy, not in parallel to it.
- Security inside normal processesHiring, product planning, procurement and sales carry security steps, rather than a separate ISMS world.
- ResourcesPeople, time, tools and budget are provided, and the decision to provide them can be seen.
- PromotionLeaders explain why security matters and expect people to follow the rules.
- Outcomes and improvementThey check the ISMS is achieving what it should, and push for it to get better.
- Support for other managersTeam leads are backed when they enforce security in their own areas.
02 · Policy and roles
The policy and the role map, in brief
5.2 and 5.3: one approved policy, and named responsibility for the system.
Clause 5.2 asks top management to set the information security policy; our policy guide covers its content. Clause 5.3 asks them to assign responsibility and authority for security roles and to make sure people know about them. Two assignments are singled out: someone must make sure the ISMS conforms to the standard, and someone must report its performance to top management.
In practice this is a short roles document or a section of the policy, plus the matching Annex A controls: 5.2 Information security roles and responsibilities, 5.3 Segregation of duties and 5.4 Management responsibilities.
03 · Evidence
Where leadership evidence comes from
Decisions leave dated traces. Collect them as they happen.
| Evidence | What it shows | Where it usually lives |
|---|---|---|
| Signed policy with a date | Leadership set direction | Document system, approval record |
| Leadership meeting minutes | Security discussed as business, with decisions | Board or leadership team notes |
| Budget line or approved purchase | Resources were provided | Finance system, approval email |
| Approved objectives | Targets were set at the top | Objectives register, review minutes |
| Risk acceptance sign-off | Leaders own the residual risk | Risk register, treatment plan |
| All-hands message or town hall slide | Security was promoted | Internal comms archive |
| Management review minutes | Performance was checked and acted on | Review pack and action log |
04 · The interview
What the top-management interview covers
Usually short, and usually early. The questions are about judgement, not jargon.
| Topic | A question an auditor might ask | An answer that tends to satisfy |
|---|---|---|
| Why the ISMS exists | Why did the company decide to do this? | A business reason in the leader's own words: a market, a customer type, a risk |
| Top risks | What worries you most about information security here? | Two or three risks that match the register |
| Objectives | How do you know the ISMS is working? | Names an objective and its current status |
| Resources | What have you given the ISMS this year? | Specific people, time or spend, with a decision behind it |
| Risk acceptance | Which risks have you chosen to accept? | Knows at least one, and why it was accepted |
| Management review | What changed after the last review? | A concrete action and who owns it |
| Incidents | Tell me about the last security incident. | Knows it happened, the impact and the follow-up |
Auditors are not looking for leaders who can recite clauses. They want to hear that security decisions are made at the top, with knowledge of the facts.
05 · Common mistakes
Where clause 5 findings come from
Almost all of them come back to delegation without involvement.
- Everything handed to the ISMS manager. The founder signs what is put in front of them and cannot answer basic questions in interview. The auditor records a leadership gap.
- A policy nobody at the top has read. Signed once, never discussed, never reviewed after a major change.
- No visible resource decision. The ISMS runs on evenings and goodwill, with no time or budget recorded anywhere.
- A management review held by one person. The ISMS manager presents to themselves. Top management has to take part.
- Top management defined too low. Naming a mid-level manager as top management when the real decisions sit with the CEO.
06 · On a small team
Leadership evidence on a small team
The founder is top management. The evidence can be light.
- A security slot in the founders' weekly meeting. Monthly is fine, with a one-line note of what was decided.
- One decision log. Date, decision, who made it: purchases, risk acceptances, objective changes.
- An annual review in one sitting. The management review held with the founders present, minutes kept.
- A short rehearsal. A practice interview with the founders before Stage 2, using the table above.
Sources: ISO/IEC 27001:2022 clause titles (5.1 Leadership and commitment, 5.2 Policy, 5.3 Organizational roles, responsibilities and authorities); ISO/IEC 27002:2022 control names 5.2, 5.3 and 5.4. Descriptions, questions and examples are Auditify's own and illustrative.
Clause 5, answered
Who counts as top management?
Whoever directs and controls the organisation, or the scoped part of it, at the highest level.
For a start-up that is usually the founders. For a unit of a larger group it can be the unit head, provided they actually make the decisions for that scope. The test is authority, not job title.
Will the auditor really interview the CEO?
Commonly, yes, or whoever holds top-management authority.
Certification audits commonly include a conversation with top management, often near the start. It is usually short. The point is to hear security described by the people who fund and direct it.
Can the ISMS manager attend the leadership interview?
Usually, but they should not answer for the leader.
Many auditors allow it. If the ISMS manager answers every question, the auditor learns that leadership is not engaged, which is the finding you are trying to avoid.
Do leaders need security training?
They need enough to make decisions, not technical depth.
A short briefing on the top risks, the objectives and their own duties under clause 5 is usually enough. Record it like any other awareness activity.
Prepare leadership for the questions only they can answer.
An ISO 27001 gap analysis includes a review of leadership evidence and a practice interview before the real one.