ISO 27001 leadership requirements for top management (clause 5)

What ISO 27001 clause 5 requires of top management

When a customer, contract or regulator asks for ISO 27001, the executive team needs to know which parts of the certification it must own personally. Clause 5 of ISO/IEC 27001:2022, published on 25 October 2022, covers three things: leadership and commitment (5.1), the information security policy (5.2), and organizational roles, responsibilities and authorities (5.3). Certification auditors test top management involvement in all three, even when an implementation partner helps build the information security management system (ISMS). A consultant can draft the policy and set up the roles, but the people at the top must be able to show they approved, understand and act on them.

How much this asks of a given leadership team depends on its size, its existing governance and how far leaders already review risk. In a small company, the chief executive may also be the risk owner, so one signed policy and a regular review slot can be enough, provided the minutes show real discussion. In a larger group, the board, a risk committee and the chief information security officer may each hold part of the picture, and the auditor will look for a clear line from the policy to the people who answer for it. Before scoping the work, confirm who sits in top management for your ISMS, which forums already discuss security, and whether any executive has been assigned formal responsibility in writing.

Ask your implementation partner and certification body to show you, in your own records, where leadership involvement appears: approved policy versions, management review agendas, role assignments and decisions on risk treatment. Guidance in ISO/IEC 27014:2020 on governing information security can help executives understand what to evaluate and direct, but it is guidance, not a certification requirement. Only an independent certification body can judge whether the evidence meets clause 5.

What each clause 5 subclause asks leaders to do

Clause 5.1 requires top management to show leadership and commitment to the information security management system. In practice, the auditor is looking for evidence that the people who own the business risk have taken the ISMS on as their own. They are not checking that a manager can recite the standard. The organization owns this obligation, and no consultant or implementation partner can carry it on its behalf.

Resource decisions: Leaders approve the budget, staff time and tooling the ISMS needs, and the approval is recorded, for example in board or executive minutes.
Integration with business processes: Leaders confirm that information security requirements are built into strategy, product plans and major projects, not added after launch.
Direction to others: Leaders communicate the importance of an effective ISMS and of meeting its requirements to managers and staff.
Support for the wider role: Leaders make sure the CISO or security lead has access to the board and the authority to escalate.
Review participation: Leaders attend or receive input for the management review under clause 9.3 and act on what it produces.

Before the audit, confirm that the minutes show leaders making these decisions, not only receiving status updates.

How the information security policy and assigned roles connect to the Annex A controls

Clause 5.2 requires top management to set the top-level information security policy, and that document is the anchor for everything below it. The Annex A controls then turn the policy into behavior. A.5.4 Management responsibilities asks management to require all personnel to apply information security in line with the established policy, topic-specific policies and procedures. A.5.36 asks the organization to check that those policies, rules and standards are actually followed, and A.5.37 asks for documented operating procedures for the activities that need them. The policy is approved by leaders, but its force depends on whether staff, suppliers and managers are held to it. Before certification, confirm who signed the policy, when it was last reviewed, and which topic-specific policies sit beneath it.

Clause 5.3 requires top management to assign roles, responsibilities and authorities for the ISMS and communicate them. Two Annex A controls put that assignment into practice. A.5.3 Segregation of duties separates conflicting duties, such as the person who approves a change from the person who deploys it, so no single role can bypass the control. A.6.2 Terms and conditions of employment brings information security responsibilities into employment and contract terms, which is where an employee or contractor's obligation to follow policy becomes enforceable. Ask whether each named role has a written mandate, whether its holder accepted it, and whether contractors who hold privileged access are bound by the same terms.

The organization owns these decisions and the resulting documents. An implementation partner can draft the policy, propose a role matrix and suggest procedure templates, but leaders must approve the wording, accept the risk trade-offs and enforce the rules in daily management. Auditors will ask leaders, not the partner, why a policy was chosen and how it is enforced. If a draft is handed back unread or no executive can explain the role assignments, the gap will surface at the first audit, so agree in writing which leaders review each document before work starts.

How auditors test management involvement at certification and surveillance visits

Auditors look for proof that top management directs the ISMS rather than delegates it entirely. The cards below describe the records an independent auditor typically asks to see at certification and surveillance visits. Preparing this evidence does not guarantee a result, because the auditor reaches its own conclusion from what it samples and observes.

Policy approval and review records

Auditors ask who approved the top-level information security policy, when, and whether it has been reviewed since. The policy should be dated, version-controlled, and visibly signed off by top management, with the approval date matching the document history. Check that the policy states the organization's commitment to meeting requirements and continual improvement, and that it is communicated to staff in a form they can find.

Management review minutes on risk and objectives

Minutes from management meetings should show leaders reviewing risk assessment results, the risk treatment plan, and progress against information security objectives. Auditors read for discussion and decisions, not attendance lists alone. Confirm the minutes record who attended, what was reviewed, which actions were agreed, and who owns each action.

Resources assigned to the ISMS

Auditors look for evidence that leaders provided the people, budget, tools and time the ISMS needs. This can include approved budget lines, headcount for security roles, purchase decisions for monitoring or backup tooling, and time allocated to internal audit. Ask for a record linking each resource decision to a specific ISMS need, so the auditor can trace it.

Assigned roles and their understanding

Clause 5.3 requires that responsibilities and authorities for the ISMS are assigned and communicated. Auditors usually interview a sample of role holders, such as the information security lead, risk owners and control owners, and check whether they can describe their duties. Keep current role descriptions, appointment letters or charters, and a record showing that each role holder accepted the assignment.

Leadership response to nonconformities

When internal audits or the certification body raise nonconformities, auditors check how top management responded. They look for accountable owners, root cause analysis, corrective actions with due dates, and verification that the fix worked. A pattern of nonconformities closed without management review or escalation is a common concern, so keep the corrective action log and the decisions that approved each closure.

How ISO/IEC 27014 guides governing bodies and top management

ISO/IEC 27014:2020, *Governance of information security*, is the companion guidance that helps governing bodies, top management and the people who run an ISMS answer a question clause 5 leaves open: how to govern information security at board level. It sets out four governance activities, evaluate, direct, monitor and communicate, and describes how each one applies to information security. Read it as a way to design the leadership routines that clause 5.1 expects you to demonstrate, such as who evaluates the risk position, who directs resources and who receives regular reporting. It is guidance, not a certifiable requirement. An auditor tests whether top management shows leadership and commitment under clause 5.1, not whether you followed ISO/IEC 27014 line by line, so you should not promise certification against it.

ISO/IEC 27014 is a second edition published in 2020 and runs to 13 pages. ISO expects it to be replaced by ISO/IEC FDIS 27014, so a document you cite today may be superseded during your certification cycle. Before naming the standard in a contract, a policy or a board paper, confirm its current status and edition with ISO through the committee page for the standard or the ISO Store, and record the edition you relied on. Ask your certification body which edition it expects you to reference, since the audit evidence is your own governance records, not the guidance text. A practical check is whether your board minutes show the four governance activities in practice: a documented security risk review, a decision on resources, a periodic report on security performance and a communication to staff or customers when the position changes.

If you buy outside help to design governance, scope the work in writing. A consultant may draft a governance charter, a board reporting pack or a terms-of-reference for a security committee, but the decisions, the signatures and the minutes must come from your own leaders. Ask any adviser to show which parts of ISO/IEC 27014 they used, which governance records you will own after handover, and how the material will be kept current if the replacement standard changes the structure. Keep this separate from the certification body, which must remain independent of the design work. For how these expectations sit alongside the policy and roles requirements, see the sections on clause 5.2 and 5.3 in this page.

How NIST CSF 2.0 and other frameworks reference leadership expectations

NIST CSF 2.0 publishes informative references that point from its governance outcomes to ISO/IEC 27001:2022 clauses and Annex A controls. Read them as pointers for planning, not as proof that one framework satisfies another. The cards below cover the mappings that touch top management and what to confirm before relying on them.

GV.PO-01 and the policy clause

The NIST CSF 2.0 Reference Tool lists GV.PO-01, which concerns cybersecurity policy, as informatively referencing ISO/IEC 27001:2022 clause 5.2 and Annex A controls 5.1, 5.37, 6.1, 6.2, 6.4, 6.5, 6.7 and 6.8. For ISO 27001 clause 5, this points to the top-level policy that top management must set and approve. Check that the policy your leadership signs is the same document your auditor samples, and that it is communicated and reviewed on the schedule you have documented.

GV.RR-02 and roles

GV.RR-02 maps to ISO/IEC 27001:2022 clause 7.2 and Annex A controls 5.2 and 5.3 in the same tool. These references touch the roles, responsibilities and authorities that clause 5.3 requires top management to assign and communicate. Confirm that the role names in your Statement of Applicability, your organizational chart and your signed role descriptions match, since an assessor will compare them.

GV.RR-01 implementation examples

NIST publishes four Implementation Examples for GV.RR-01. They describe leaders agreeing on their roles in cybersecurity strategy, sharing expectations for a secure and ethical culture, directing the CISO to review the risk strategy at least annually and after major events, and reviewing whether authority and coordination are adequate. These are useful prompts for leadership agendas, but they are examples from NIST, not ISO requirements. Record your own equivalent decisions with dates and names.

Annex A controls 5.4 and 5.36

Control A.5.4 asks management to require all personnel to apply information security under the established policy and procedures, and A.5.36 concerns compliance with those policies, rules and standards. Together with clause 5.1 on leadership and commitment, they show why management involvement is tested through evidence of direction, not just a signed policy. Ask who reviews compliance results and how exceptions are approved and recorded.

Mapping scope and confirmation

Informative references show where two frameworks discuss similar subjects. They do not show that meeting one meets the other, and they assume the same scope, risk assessment and evidence. Before using any mapping in an audit or customer response, confirm it against your own ISMS scope, your Statement of Applicability and the current wording of ISO/IEC 27001:2022 with your certification body or assessor. Keep a short note of which mappings you checked and who approved them.

Why leadership accountability cannot be handed to a consultant

The organization owns its management system, and that ownership cannot be outsourced. Under clause 5.1, top management must demonstrate leadership and commitment to the information security management system, which means its own people make the decisions the system depends on: accepting risk, approving the scope, funding the work and holding owners to account. An implementation partner can draft the policy under clause 5.2, prepare the roles described in clause 5.3, assemble the risk records and build the evidence trail. It cannot sign the policy on the board's behalf, decide which risks the business will carry, or attend the management review under clause 9.3 and answer for its outcome. Before work starts, confirm in writing which named executive approves each decision, and who attends each recurring governance meeting.

Independence rules point the same way. European Accreditation FAQ 33.15 addresses consultancy in the context of certification, and FAQ 49.4 explains that certification bodies must manage impartiality risks under ISO/IEC 27006-1. In practice, a certification body will not certify a system that the same firm designed and operated, because the auditor would be assessing its own work. Decide early whether the firm helping you build the system will also be a candidate auditor, and ask your certification body how it handles that conflict before you sign an engagement letter. The safer arrangement keeps implementation and certification with separate organizations.

Auditors test whether leadership involvement is real, not whether a consultant was present. Expect questions about who approved the policy, when top management last reviewed information security risk, and how the leaders' responsibilities were communicated to the people they manage. Keep dated minutes, approved versions and decision records that name the executive, not the adviser. Consider a short internal exercise: ask each senior leader to explain, without notes, what they are accountable for in the ISMS and what they would do if a major risk changed. Gaps in those answers are the cheapest findings to fix before an audit.

What leaders should do before the first certification audit

This sequence gives top management a documented, approved and assigned set of leadership artifacts that the certification body can test on its first visit. Each step closes with a record that shows management decided, not just delegated.

Confirm the ISMS scope and executive owner
Top management confirms the boundaries of the information security management system, including the business units, locations, systems and services in and out of scope, and names one executive accountable for the ISMS. The CEO or another board-level sponsor typically signs off, because the scope drives every later decision. Done means a written scope statement, approved by top management and dated, with the executive owner named in it. Ask the certification body how it expects scope exclusions to be justified before you finalize the wording.
Approve the information security policy
Top management reviews the high-level information security policy drafted for clause 5.2, checks that it fits the business context and the scope, and formally approves it. The approval is a deliberate act by the people who hold authority, not a sign-off by a delegate. Done means a signed or formally recorded approval of a version-controlled policy, with a review date and a record of who approved it. Confirm with your certification body how it wants approval recorded and whether it expects evidence of communication to staff.
Assign roles, responsibilities and authorities in writing
Top management assigns responsibility and authority for the ISMS, its reporting to top management, and the day-to-day roles that operate controls, as required by clause 5.3. Segregation of duties and the people who make risk decisions should be explicit, so that no single person both designs and approves a control they run. Done means a written roles document or responsibility matrix, accepted by the people named and linked to the Statement of Applicability. Confirm with the auditor whether it expects the matrix to cover asset owners and control owners.
Review the risk assessment approach
Before the first audit, top management reviews the method the organization uses to identify, analyze and evaluate information security risks, and confirms the risk acceptance criteria. Leaders decide who may accept residual risk and at what level, which is a management decision the auditor will ask about. Done means an approved risk methodology and documented risk acceptance criteria, with a record of the review. Ask the certification body which risk method it has accepted for assessment and whether it expects reference to ISO/IEC 27005 guidance.
Set the schedule for management review inputs
Top management agrees a calendar for the management review and the standing inputs it will receive, such as audit results, incident trends, risk changes, objective performance and feedback from interested parties. The owner of each input is named so that data arrives on time and in a consistent form. Done means an approved schedule and an input checklist, held as a controlled document. The exact frequency and timing should be confirmed with the certification body, since it will test whether the management review has actually run before the audit.
Arrange leadership attendance at the management review
Top management confirms that the decision makers attend the management review in person or by documented remote participation, and that the agenda covers the required inputs and expected outputs. Attendance records matter because an auditor tests whether leaders engaged with the ISMS, not only whether a meeting took place. Done means attendance recorded in the minutes, decisions and actions with owners and due dates, and minutes approved by the chair. Ask the auditor how it samples management review records and what evidence of leader involvement it reviews.

Leadership readiness checks to run before the audit

Certification auditors test clause 5 by asking for dated records, not assurances from leaders. The six checks below turn each leadership expectation into a document, a meeting or a decision that the organization can produce on the day of the audit. Each check names who should sign it off, so gaps are closed by the owner rather than by the consultant.

Policy approved and dated

Confirm that the top-level information security policy under clause 5.2 carries the approval of top management, a date, a version number and the name of the approver. Check that the scope of the ISMS and the policy's stated objectives match the current Statement of Applicability. The chief executive or the board chair should sign off, and the policy should show when it was last reviewed. A policy approved after the audit date is a common nonconformity.

Roles and authorities documented

Check that the ISMS roles under clause 5.3 are written down, including who owns the ISMS, who approves risk acceptance and who reports to top management. Confirm that each named person has accepted the responsibility and that staff can find the role descriptions. The chief executive should approve the role matrix, and each role holder should confirm in writing that they understand their authority.

Leadership resources recorded

Look for a record showing that top management decided what people, budget and tools the ISMS needs, and why. Auditors compare this record with the risk treatment plan and the audit findings. Confirm that the decision includes named owners and dates for any resource gaps. The finance lead and the security owner should sign off, and the minutes should show the decision was taken by someone with authority to commit funds.

Management review held and minuted

Check that a management review took place at planned intervals and that the minutes cover the required inputs, including audit results, risk changes and feedback from interested parties. Confirm that the minutes record decisions and actions with owners. The chair of the review should approve the minutes, and the ISMS owner should confirm that each action has a status. The detailed requirements sit under clause 9.3, covered separately on this site.

Governance reporting to the board

Confirm that the board or an equivalent governing body receives regular information security reports that cover risk, incidents, audit results and objectives. Check the board minutes for a discussion, a question or a decision on the report, not only a note that it was received. The board secretary or the chair should confirm the agenda entry. ISO/IEC 27014 offers useful guidance on how governing bodies can evaluate, direct and monitor security, and it may help structure the reports.

Leaders acted on prior findings

Auditors look for proof that leaders responded to earlier audit findings, incidents and management review actions. Gather the corrective action records, their approval dates and the evidence that each action was closed or escalated. Check that leaders reviewed the status of open items rather than leaving them to the ISMS team. The accountable executive should sign off the closure, and the internal auditor should confirm that the actions addressed the root cause.

Who does what: leaders, an implementation partner and the certification body

Top management is the people with authority to set direction and commit resources for the organization as a whole, usually the chief executive and the executives who own the business. Under clause 5, this group must visibly lead the information security management system (ISMS), approve the information security policy and make sure the roles behind it are assigned and resourced. No consultant or partner can perform these acts on the organization's behalf, and an auditor will look for evidence that the executives themselves did them.

Approving the policy: The top-level information security policy under clause 5.2 needs a documented approval by top management, with a recorded date and a review cycle.
Setting objectives and funding: Management decides the security objectives and provides the budget, staff time and tools needed to reach them. Ask for the minutes or budget decisions that show this.
Owning risk acceptance: Decisions to accept residual risk, and the criteria for doing so, belong to named managers, not to the implementation team.
Directing and reviewing: Leaders review the ISMS at planned intervals through management review under clause 9.3 and direct corrective action when results fall short.
Assigning roles: Under clause 5.3 and control A.5.4, leaders confirm who is accountable for what and require staff to follow the policy.

Before certification, confirm that each executive can name the policy they approved, the risks they accepted and the last review they attended, because auditors often ask these questions directly.

Leadership questions buyers ask before hiring outside help

How much time do top managers need to commit to ISO 27001 leadership?

The time is set by the organization's size, risk profile and how many decisions must come from the top, not by a fixed formula. Clause 5.1 expects top management to show leadership and commitment, which in practice means reviewing the ISMS direction, approving resources, setting risk appetite, and attending the reviews where those decisions are recorded. Drivers that increase the load include multiple sites, several regulated customers with their own demands, a large number of in-scope systems, and a new ISMS that has not yet settled its roles. Ask any outside party to show you, in writing, which leadership decisions and meetings they expect from your executives, and how many of them fall in each quarter. Your own calendar, not a consultant's estimate, should determine whether the commitment is realistic.

Can a consultant write the information security policy for the CEO to sign?

Yes, a consultant or implementation partner can draft the policy, but the CEO or other top manager must review, approve and own it. Clause 5.2 requires top management to establish the information security policy, so an approval signed by someone outside the leadership team does not meet the requirement. A useful draft should match the organization's real context, objectives and risk approach, and leaders should be able to explain each commitment in it. Auditors often ask managers to describe the policy in their own words during interviews. Keep the approval record, the version history and the communication to staff as evidence, and make sure the policy is consistent with the Statement of Applicability and the risk assessment.

Can an implementation partner run the management review for us?

A partner can prepare the materials, but leaders must chair the management review and make its decisions. Clause 9.3 sets out the inputs the review must consider and the outputs it must produce, such as decisions about improvement and resource needs. A partner can collect status on risks, audit findings, objectives and nonconformities, and draft the agenda and minutes. The minutes should show that managers discussed the material, challenged it and decided on actions with owners and dates. If the minutes read as if an outside party made the decisions, an assessor is likely to question whether top management is actually involved. Confirm the chair, attendees and decision rights in writing before the first review.

What does ISO/IEC 27014 change for the board?

ISO/IEC 27014:2020 does not add requirements to ISO 27001, but it gives governing bodies a structured way to evaluate, direct, monitor and communicate about information security. For a board, that means moving from a yearly update on tooling to regular oversight of risk appetite, resources, significant incidents and the performance of the ISMS. The guidance is addressed to governing bodies, top management and those responsible for the ISMS, so it helps define how the board and executives split their work. Note that ISO expects ISO/IEC 27014 to be replaced by ISO/IEC FDIS 27014, so check the current edition before you base board terms of reference on it. Use the guidance as a reference for designing reporting, not as a certification input.

How do auditors judge weak leadership involvement in an ISMS?

Auditors look for evidence that top management directs the ISMS rather than simply tolerating it. They typically interview executives, read management review minutes, check that the policy was approved and communicated, and test whether roles and authorities under clause 5.3 are understood and exercised. Warning signs include executives who cannot name the policy objectives, reviews that never record a decision, budget requests that are never approved, and risk acceptances signed by staff below the appropriate authority. Weak involvement often leads to a nonconformity against clause 5, which can be raised even when the technical controls are strong. Ask your certification body to explain how it samples leadership evidence during the audit, and prepare managers to speak to their own responsibilities.

Can one firm both implement the ISMS and certify it?

No. A firm that designed and ran your ISMS cannot also be the certification body that audits the same certification, because the conflict of interest would undermine impartiality. Accredited certification bodies work under ISO/IEC 17021-1 and ISO/IEC 27006-1, which require them to identify and manage impartiality risks, and European Accreditation guidance addresses consultancy that creates such conflicts. Your implementation partner can prepare systems, controls and evidence, and an independent auditor or certification body then assesses them and issues any certificate. Ask the certification body in writing how it manages consultancy and conflicts of interest, and keep the roles of each party documented in the engagement scope.

How DeployOpen prepares leadership evidence for your ISMS

DeployOpen works on the infrastructure and documentation side of ISO 27001 leadership requirements for top management (clause 5). We prepare the systems, records and evidence that show management involvement, while your leadership owns the policy, roles and decisions that an independent certification body will test.

How we scope

Written scope agreed before work starts, listing which clause 5 evidence sets DeployOpen will prepare.
Confirmation of which management records already exist, such as policy approvals and role assignments, and which are missing.
Clear split of responsibilities: your leadership sets the policy and authorities, DeployOpen prepares the supporting systems and records.

How we build

Self-hosted, open-source record keeping for policy versions, approval history and role assignments inside your own infrastructure.
Documented workflows for management review inputs and actions, so leadership decisions leave a traceable record.
Access controls and versioning on policy documents so auditors can see who approved what, and when.

How we hand over

Documentation of every system, configuration and record set we prepared, so your team can run it without us.
Walkthrough sessions with the leaders and managers who own each clause 5 record, so they can explain it to an auditor.
A handover list of evidence owners, review cycles and open items, agreed in writing at the close of the engagement.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer after handover.
Support can cover updates to policies, role changes and new evidence requests ahead of surveillance or recertification audits.
Confirm with the certification body which evidence it expects for clause 5, since DeployOpen prepares evidence but does not issue certificates.