CEO delegation and an ERP procurement
Helios Engineering has held ISO 27001:2013 certification since 2017. Its ISMS is run by a two-person security team; the CEO signs the information security policy annually but has not attended a management review since 2022. The most recent management review, in January 2024, covered only phishing click rates and open audit findings. The transition to ISO 27001:2022 introduces new requirements for top management to ensure the ISMS is integrated into the organization's business processes (clause 5.1) and for management review to consider changes in external and internal issues, feedback on information security performance, and results of risk assessment (clause 9.3). Helios has also appointed a new 'Head of Digital Transformation' who is procuring a multi-tenant SaaS ERP and a managed detection and response service. The security team asks the CEO to chair a transition steering group, but the CEO says security is 'delegated to the CISO' and asks for a one-page summary instead.
1. Assess whether Helios's leadership arrangements satisfy clauses 5.1 and 5.3 for the 2022 transition. Identify the specific gaps an auditor would probe and the evidence that would close them.
Read the worked answer
Clause 5.1 requires top management to demonstrate leadership and commitment by ensuring the policy and objectives are compatible with strategic direction, integrating ISMS requirements into business processes, providing resources, communicating importance, and promoting improvement. Clause 5.3 allows operational responsibility to be delegated but not accountability. Helios's CEO signs a policy annually and receives a one-page summary; that is visible support, not evidence of integration. The auditor would probe: who approved the ISMS scope and risk treatment plan; whether the ERP and MDR procurements included security requirements; whether the CEO has made decisions on risk acceptance or resources; and whether management review minutes show strategic issues, not only phishing rates. The 2022 management review input list (clause 9.3) includes changes in external and internal issues, performance feedback, risk assessment results and improvement opportunities - Helios's January 2024 review covered none of these adequately. To close the gaps, the CEO should chair a transition steering group with recorded decisions, require security requirements in the ERP business case, approve the updated SoA, and ensure the CISO's authority is documented in a delegation matrix and communicated. A one-page summary can inform the CEO, but it cannot replace decisions and integration.
2. The ERP procurement is a live test of 'integration into business processes'. What should top management require so that clause 5.1 is evidenced, and how should the CISO's authority be documented?
Read the worked answer
Top management should treat the ERP procurement as an ISMS change, not a purely commercial project. Before contract signature it should require a risk assessment covering multi-tenant architecture, data residency, identity integration, export and exit, and supplier assurance; security requirements in the tender and contract (A.5.19–A.5.23); a data classification and migration plan; and acceptance criteria that include security testing. The steering group should record the decision to proceed, the accepted risks and the resources assigned. That record is direct evidence that ISMS requirements are integrated into a business process. For clause 5.3, the CISO's authority should be set out in a job description and a delegation matrix: which decisions the CISO can take, which risks must be escalated, who can approve exceptions, and how the role is communicated internally and to suppliers. The CEO remains accountable for the ISMS. The test is not whether the CISO is named, but whether staff and projects know the CISO's authority and use it. A procurement that bypasses the CISO would show the delegation is nominal.