Leadership, Commitment and the Information Security Policy (ISO/IEC 27001 Clause 5): A Complete Guide for ISO 27001 Lead Auditors
Overview
Clause 5 of ISO/IEC 27001:2022, titled Leadership, is one of the most heavily examined and audited parts of the standard. It contains three sub-clauses:
• 5.1 Leadership and commitment: what top management must personally demonstrate.
• 5.2 Policy: the requirements for the top-level information security policy.
• 5.3 Organizational roles, responsibilities and authorities: how accountability for the ISMS is assigned and communicated.
For a Lead Auditor candidate, Clause 5 matters because it tests whether you can tell the difference between an ISMS that is owned by the organization's leaders and one that is merely delegated to an IT or compliance team. Exam scenarios often describe a well-documented ISMS that fails because leadership is absent. Your job is to spot that and link it to the correct clause.
1. Why Clause 5 Is Important
• Accountability starts at the top. Information security is a business risk, not just a technical one. Without top management involvement, the ISMS lacks authority, budget and strategic alignment.
• It drives every other clause. Leadership sets the policy (5.2), which frames the objectives (6.2). Leadership provides resources (7.1), takes part in management review (9.3) and promotes improvement (10). A weak Clause 5 usually causes failures elsewhere.
• It prevents the 'paper ISMS'. Certification bodies look for real evidence that the ISMS is part of how the business runs. It must not be a parallel system maintained only for the certificate.
• It sets culture. Staff take security seriously when leaders visibly do so. Clause 5.1 d) and f) specifically require communication and support from leadership.
• It is a common source of major nonconformities. A missing policy, no assigned ISMS responsibilities, or top management with no involvement can each point to a systemic failure.
2. What It Is: The Requirements in Detail
2.1 Who is 'Top Management'?
Top management is defined (ISO/IEC 27000 and the Harmonized Structure, formerly Annex SL) as the person or group of people who directs and controls an organization at the highest level. Typical examples are the CEO, managing director, board or executive committee. If the ISMS scope covers only part of an organization, top management means those who direct and control that part.
Key point: top management may delegate authority and tasks, for example to a CISO. They cannot delegate their accountability for the effectiveness of the ISMS.
2.2 Clause 5.1: Leadership and Commitment
Top management shall demonstrate leadership and commitment to the ISMS by:
a) ensuring the information security policy and information security objectives are established and are compatible with the strategic direction of the organization;
b) ensuring the ISMS requirements are integrated into the organization's processes;
c) ensuring the resources needed for the ISMS are available;
d) communicating the importance of effective information security management and of conforming to the ISMS requirements;
e) ensuring the ISMS achieves its intended outcome(s);
f) directing and supporting persons to contribute to the effectiveness of the ISMS;
g) promoting continual improvement;
h) supporting other relevant management roles to demonstrate their leadership as it applies to their areas of responsibility.
Note: the word 'business' in the standard is read broadly. It means the activities core to the organization's existence, whether it is a company, public body or non-profit.
Notice the verbs: ensuring, communicating, directing, supporting, promoting. Top management does not have to do everything personally. They must make sure it happens and be visibly involved.
2.3 Clause 5.2: Information Security Policy
Top management shall establish an information security policy that:
a) is appropriate to the purpose of the organization;
b) includes information security objectives (see 6.2) or provides the framework for setting them;
c) includes a commitment to satisfy applicable requirements related to information security, such as legal, regulatory, contractual and interested party requirements;
d) includes a commitment to continual improvement of the ISMS.
The policy shall:
e) be available as documented information;
f) be communicated within the organization;
g) be available to interested parties, as appropriate.
2.4 Clause 5.3: Roles, Responsibilities and Authorities
Top management shall ensure that responsibilities and authorities for roles relevant to information security are assigned and communicated within the organization. The 2022 edition added the phrase 'within the organization'.
Top management shall assign responsibility and authority for:
a) ensuring the ISMS conforms to the requirements of ISO/IEC 27001;
b) reporting on the performance of the ISMS to top management.
2.5 How Clause 5 Relates to Annex A Controls
Candidates often confuse the Clause 5.2 top-level policy with Annex A controls. Keep them distinct:
• A.5.1 Policies for information security: requires the top-level policy and topic-specific policies (for example access control, cryptography, backup). These must be defined, approved by management, published, communicated to and acknowledged by relevant personnel and interested parties, and reviewed at planned intervals and when significant changes occur.
• A.5.2 Information security roles and responsibilities: roles defined and allocated according to organizational needs.
• A.5.3 Segregation of duties.
• A.5.4 Management responsibilities: management requires all personnel to apply security in line with the policies and procedures.
Clause 5 requirements are mandatory and cannot be excluded. Annex A controls are selected through risk treatment and justified in the Statement of Applicability.
3. How It Works in Practice
3.1 Demonstrating Leadership
Typical evidence includes:
• Top management chairs or attends management reviews (9.3), with minutes recording their decisions.
• Security is included in strategic plans, budgets and board agendas.
• Resources are approved: headcount, tools, training budgets.
• Leaders send communications on security, such as emails, town halls and intranet messages.
• Security requirements are embedded in business processes: procurement, HR onboarding, project management and change management.
• Leaders take part in risk acceptance decisions and approve the risk treatment plan.
3.2 The Policy Lifecycle
1. Draft: often prepared by the CISO or ISMS manager.
2. Review against context (4.1), interested party needs (4.2) and strategy.
3. Approve and establish: top management formally approves it. A signature or approval record is common evidence.
4. Publish as controlled documented information (7.5).
5. Communicate through induction, awareness training (7.3) and the intranet.
6. Make it available to interested parties as appropriate, for example on a website or on request by customers.
7. Review at planned intervals and after significant changes.
3.3 Assigning Roles
Common mechanisms include a RACI matrix, job descriptions, appointment letters, an ISMS steering committee charter, and documented owners for risks and assets. There must be a clear person or function responsible for ISMS conformity and for reporting performance to top management.
3.4 How an Auditor Audits Clause 5
• Interview top management directly. Ask how security supports strategy, what the objectives are, how they know the ISMS is effective, and what resources they have approved. An auditor who only interviews the CISO cannot properly assess 5.1.
• Review the policy against points a) to g) of 5.2.
• Sample employees and ask whether they know the policy and their role in it. This tests communication.
• Trace consistency: policy, objectives (6.2), measurement (9.1), management review (9.3) and improvement (10).
• Check role assignments through organization charts, RACI and job descriptions, and confirm the people involved know their responsibilities.
3.5 Typical Nonconformities
• Policy approved only by the IT manager, with no evidence of top management involvement (5.2 / 5.1 a).
• Policy has no commitment to continual improvement or to meeting applicable requirements (5.2 c, d).
• Policy exists but staff are unaware of it (5.2 f, and possibly 7.3).
• No one is assigned to report ISMS performance to top management (5.3 b).
• Security project repeatedly unfunded despite identified high risks (5.1 c).
• Top management skips management reviews or cannot describe the ISMS objectives (5.1 a, e).
• Objectives inconsistent with the business strategy (5.1 a).
Grading: a complete absence of leadership involvement, or no policy at all, is usually a major nonconformity because it is systemic. An isolated lapse, such as one department not having received the latest policy version, is typically minor.
4. Exam Tips: Answering Questions on Leadership, Commitment and the Information Security Policy
Tip 1: Know the exact wording and lists. Memorize the eight points of 5.1 (a to h), the four content requirements of 5.2 (a to d) plus the three handling requirements (e to g), and the two assigned responsibilities of 5.3. Many multiple-choice questions offer plausible distractors that are not actual requirements, for example 'the policy shall list all Annex A controls' or 'the policy shall be reviewed annually'. ISO/IEC 27001 Clause 5.2 does not specify an annual review.
Tip 2: Accountability versus delegation. If a scenario says 'the CEO delegated all security matters to the CISO and has no further involvement', the answer is a nonconformity against 5.1. Delegating tasks is allowed. Abdicating accountability is not.
Tip 3: Identify the right clause. Practise mapping evidence to clauses:
• Staff unaware of the policy: 5.2 f) (communication), with possible links to 7.3 (awareness) and 7.4 (communication).
• No budget for security: 5.1 c) and 7.1 (resources).
• Objectives not aligned with strategy: 5.1 a) and 6.2.
• No one reports ISMS performance: 5.3 b).
• Topic-specific policy not reviewed: Annex A 5.1, not Clause 5.2.
Exams reward the most specific and direct clause reference.
Tip 4: Clause 5.2 policy versus topic-specific policies. If the question concerns the overall ISMS policy set by top management, cite Clause 5.2. If it concerns access control, acceptable use or other specific policies, cite Annex A 5.1.
Tip 5: Think like an auditor in scenario questions. For 'what would you do next' or 'what evidence would you seek' questions, choose answers that:
• interview top management directly;
• verify objective evidence such as minutes, approvals, budgets and communications;
• sample staff to confirm awareness;
• avoid giving consultancy advice. An auditor reports findings and does not design the solution.
Tip 6: Watch for absolute words. Options containing 'must personally write', 'only the CEO' or 'annually' are often wrong. The standard is non-prescriptive about who exactly and how often. It requires that top management ensure and demonstrate.
Tip 7: Policy is 'available', not necessarily 'published publicly'. The policy must be available to interested parties as appropriate. It does not have to be on a public website. A wrong option may claim it must be made public.
Tip 8: Grade nonconformities carefully. In essay or case-study answers, justify the grade:
• Major: the requirement is not addressed at all, or there is a systemic breakdown, such as no policy or no leadership engagement.
• Minor: an isolated, non-systemic lapse.
Write findings with three parts: the requirement (clause), the evidence (what you observed) and the statement of nonconformity.
Tip 9: Link Clause 5 to the PDCA cycle. Leadership sits at the centre of the Plan-Do-Check-Act model. Mentioning the links to 6.2 (objectives), 7.1 (resources), 9.3 (management review) and 10 (improvement) shows deeper understanding in written answers.
Tip 10: Remember the 2022 changes. Clause 5.3 now states that roles are communicated 'within the organization'. Annex A was restructured to 93 controls, and the policy control is now A.5.1, which combines the former A.5.1.1 and A.5.1.2. The Clause 5 requirements themselves are otherwise largely unchanged from 2013.
5. Sample Exam Questions
Q1. During an audit, the IT Director signed the information security policy. The CEO states that security is 'an IT matter' and has never attended a management review. What is the most appropriate finding?
Answer: A nonconformity against Clause 5.1, specifically items a), c) and e), and possibly 9.3. Top management has not demonstrated leadership and commitment. Because it is systemic, it is likely a major nonconformity.
Q2. Which of the following is NOT a Clause 5.2 requirement? (a) commitment to continual improvement; (b) framework for setting objectives; (c) annual review by the board; (d) commitment to satisfy applicable requirements.
Answer: (c). ISO/IEC 27001 does not specify an annual review in Clause 5.2.
Q3. Staff interviewed in three departments could not locate or describe the information security policy. Which requirement is most directly affected?
Answer: Clause 5.2 f), the policy must be communicated within the organization. Clause 7.3 (awareness) is supporting evidence.
Q4. What two responsibilities must top management assign under Clause 5.3?
Answer: (a) ensuring the ISMS conforms to the requirements of ISO/IEC 27001; (b) reporting on ISMS performance to top management.
Q5. The organization's access control policy has not been reviewed for four years despite a major cloud migration. Which requirement applies?
Answer: Annex A control 5.1, which requires topic-specific policies to be reviewed at planned intervals and when significant changes occur. Clause 5.2 does not apply because this is a topic-specific policy.
6. Quick Revision Summary
• 5.1: top management demonstrates leadership through 8 actions covering policy and objectives, integration, resources, communication, outcomes, direction, improvement, and support for other managers.
• 5.2: the policy must be appropriate, include or frame objectives, commit to requirements, commit to improvement, be documented, be communicated internally, and be available to interested parties as appropriate.
• 5.3: roles are assigned and communicated; someone is responsible for conformity and for performance reporting.
• Authority can be delegated. Accountability cannot.
• The Clause 5.2 policy is mandatory. Topic-specific policies fall under Annex A 5.1.
• Auditors must gather evidence from top management themselves, not only from the security team.
Master these points and you will be able to answer both knowledge-based and scenario-based questions on Clause 5 with confidence.
