Leadership Sign-Off Without Authority
At Meridian Logistics, the Information Security Manager (ISM) has drafted the ISMS policy, risk treatment plan, and a set of 14 security objectives. The CEO signed the policy at a town hall but has since delegated all ISMS decisions to the ISM, saying "security is your area." The risk treatment plan requires a €180,000 spend on endpoint detection and a change to the procurement process that affects three departments. The ISM has authority to approve neither the budget nor the process change. At the management review, the ISM presented the risk register alone; no department heads attended. Two of the 14 objectives have no owner and no measurement method. The certification body's Stage 1 audit is in eight weeks.
1. Identify the leadership and planning failures here using ISO/IEC 27001 clauses. Why is "the CEO signed the policy" insufficient evidence of leadership?
Read the worked answer
Clause 5.1 requires top management to demonstrate leadership by ensuring resources are available, integrating ISMS requirements into business processes, and directing/supporting persons who contribute to effectiveness. A signature is an artifact; leadership is evidenced by decisions and resourcing.
Specific failures:
- Clause 5.1 / 7.1 (resources): the €180k treatment and the procurement change are unfunded and unowned. The risk treatment plan (Clause 6.1.3) is not implementable without authority behind it.
- Clause 5.1: delegating "all ISMS decisions" to the ISM without authority to approve budget or cross-department process change means the ISM cannot discharge the role. Top management has not integrated the ISMS into business processes.
- Clause 6.2 (objectives): two objectives lack an owner and a measurement method, so they cannot be planned or evaluated. Objectives must be measurable, monitored, and assigned.
- Clause 9.3 (management review): review without department heads and without resourcing decisions is a paper exercise.
The fix is not a new signature; it is a decision record: budget approved or the risk formally accepted by the CEO, process change mandated through the relevant owners, and objectives assigned with metrics.
2. The ISM proposes to drop the two unowned objectives before Stage 1 to "clean up" the documentation. Assess this.
Read the worked answer
Dropping objectives to tidy the paperwork is the wrong instinct and is itself a finding. Clause 6.2 requires objectives that are consistent with the policy, measurable, monitored, communicated, and updated, with defined ownership and what will be done to achieve them. If the two objectives were genuinely not relevant, removing them is legitimate - but only via a documented decision that explains why they no longer serve the ISMS, not because they were inconvenient.
More likely, the objectives are relevant but unmanaged. The correct action is to assign an owner, define a measurement method and baseline, and set a review cadence - before Stage 1. An auditor who sees objectives quietly deleted shortly before audit will probe the decision process (Clause 9.3 inputs, Clause 7.5 documented information control).
A defensible path: either (a) assign owners and metrics now and show the plan, or (b) formally remove them with a recorded rationale tied to risk and policy. Option (a) is stronger because it demonstrates the management system is working, which is what Stage 1 is assessing.