Leadership and Planning
Clause 5 (Leadership) and Clause 6 (Planning) are where top management commits and where risk is turned into action. Under leadership, top management must demonstrate commitment by ensuring the information security policy is established and compatible with strategic direction, integrating ISMS requirements into business processes, providing resources, communicating the importance of the ISMS, and promoting continual improvement. Roles, responsibilities, and authorities must be assigned and communicated. A frequent trap: assuming leadership can be delegated to the security manager. The standard requires top management accountability; delegation of tasks is fine, but accountability is not transferable.
Planning (Clause 6) has two halves. First, risk planning: the organization must define and apply an information security risk assessment process (identify risks, analyse, evaluate against criteria) and a risk treatment process (select options, determine controls, produce a Statement of Applicability, and obtain risk-owner approval). Second, objectives planning: information security objectives must be measurable (where practicable), monitored, communicated, and supported by plans answering who, what, resources, when, and how results are evaluated.
Traps to watch: (1) thinking the risk assessment is a one-time event-it must be repeated at planned intervals or when significant change occurs; (2) forgetting the SoA must justify both included controls and why Annex A controls are excluded; (3) confusing risk assessment with risk treatment; (4) assuming all Annex A controls must be implemented-only those justified by risk (or legal/contractual need) are required.
Worked rule of thumb: risk assessment = "what could happen and how bad?"; risk treatment = "what will we do about it and who approves?" The SoA is the bridge between them and Annex A.