Leadership (Clause 5)
Leadership (Clause 5)
Clause 5 is about direction, not delegation. The exam tests whether top management actually leads the ISMS, whether the policy satisfies 5.2, and whether roles and authorities are assigned in a way that supports conformity and reporting.
Core rules
- 5.1: top management must demonstrate leadership and commitment by ensuring policy and objectives are compatible with strategic direction; integrating ISMS requirements into business processes; ensuring resources; communicating importance; ensuring intended outcomes; directing and supporting people; promoting improvement; and supporting other management roles.
- 5.2: the information security policy must be appropriate to purpose, include objectives or a framework for setting them, include commitment to satisfy applicable requirements and to continual improvement, be documented, communicated within the organization, and available to interested parties as appropriate.
- 5.3: assign responsibilities and authorities for ISMS conformity, reporting performance, and related roles. Authorities should cover escalation, risk decisions, and control ownership.
Worked example
A CEO signs a one-page policy and tells the IT manager to 'handle ISO'. The IT manager cannot change HR onboarding, procurement, or legal contracts. Exam reasoning: 5.1 fails because top management has not integrated requirements into business processes or ensured resources and authority across functions. A compliant approach has executive sponsorship, cross-functional objectives, and a management review that resolves conflicts. Delegating the ISMS coordinator role is acceptable; delegating leadership accountability is not.
Traps that cost marks
- Equating top management with the security team or the ISMS manager.
- A policy that mentions confidentiality only, lacks continual improvement, or is not communicated.
- Assigning 5.3 responsibilities on an org chart without authorities to act or escalate.
- Claiming leadership through a signed memo while business processes remain unchanged.