Clause 5: Leadership

Requirement
Top management must demonstrate leadership and commitment to the ISMS by ensuring the information security policy and objectives are established and aligned with the organisation’s strategic direction, integrating ISMS requirements into business processes, ensuring resources are available, communicating the importance of information security, ensuring the ISMS achieves its intended outcomes, directing and supporting staff, promoting continual improvement, and supporting other managers in their own leadership roles.

How to Implement
Top management should chair or actively participate in management reviews, and ideally approve the information security policy personally. In addition, they should allocate a real budget and headcount to the ISMS rather than just signing off on it. Communication matters here too: staff should be able to point to visible evidence that leadership cares, such as a kickoff announcement, periodic internal messaging, or leadership attendance at security training sessions. As a result, management’s commitment should be captured through meeting minutes, approved budgets, and signed policies.

Mandatory Documents
ISO/IEC 27001:2022 does not explicitly state that documented information on leadership and commitment itself “shall be available,” so there is no single mandatory document for 5.1. However, evidence of commitment typically surfaces indirectly through other mandatory records, such as:

• The approved policy (see 5.2)
• Management review minutes (see 9.3)
• Resource allocation records

Requirement
Top management must establish an information security policy that is appropriate to the organisation’s purpose, includes information security objectives (or a framework for setting them), includes a commitment to satisfy applicable requirements, and includes a commitment to continual improvement. The policy must be documented, communicated internally, and made available to interested parties as appropriate.

How to Implement
Draft a policy that is short, high-level, and readable, ideally a page or two rather than a technical manual. It should state what information security means for your organisation, your commitment to protecting confidentiality, integrity, and availability, and your commitment to meeting legal, regulatory, and contractual obligations. Once top management has signed and dated it, distribute it to all staff, often via induction training or an intranet posting, and make a version available to external parties such as clients or auditors who request it.

Mandatory Documents
Yes, this is explicitly mandatory. ISO/IEC 27001:2022 states the policy “shall be available as documented information.” Therefore you must produce and maintain:

• A signed, approved Information Security Policy

Requirement

Requirement
Top management must ensure that responsibilities and authorities for information-security-relevant roles are assigned and communicated. In particular, someone must be responsible for ensuring the ISMS conforms to the standard, and someone must be responsible for reporting on ISMS performance to top management.

How to Implement
Appoint a Management Representative or ISMS Manager, sometimes a CISO or similar, with clear authority to run the system day to day. Then build a RACI matrix or organisational chart showing who owns risk assessment, who owns incident response, who owns policy maintenance, and who reports to top management. Finally, communicate these roles clearly, ideally in job descriptions and the ISMS documentation itself, so there is no ambiguity about who does what.

Mandatory Documents
ISO/IEC 27001:2022 does not explicitly require documented information here (there is a NOTE, but no “shall be available” wording), so there is no mandatory document for 5.3. Nonetheless, it is good practice to maintain:

• A Roles and Responsibilities Matrix or updated job descriptions, since auditors routinely ask to see evidence that roles are assigned and communicated, even without a formal mandate