A.5.4
Management responsibilities
Organizational controlsCheckpoints 6Evidence 6Cases 6
Control objective
This control ensures that management treats information security as part of running the organization and formally requires all personnel and relevant parties to apply security in line with the established information security policy, topic-specific policies, and procedures. Without clear direction and visible commitment from management, a policy stays a document and never turns into practice on the ground. The control works to spread policy compliance as a shared responsibility and part of the culture across the organization, and requires management to provide the resources and conditions that personnel need to be aware of and fulfill their security responsibilities.
Key checkpoints
- Does management formally require all personnel to comply with information security policies and procedures, and communicate those expectations clearly?
- Is there a procedure to brief new joiners and role changers on their role-specific security responsibilities at the point of hiring/assignment?
- Does management provide access to policies/procedures, training, and the knowledge/skills that personnel need to fulfill their security responsibilities?
- Does management allocate resources (budget, staff, time) for information security activities and give them appropriate priority?
- Are channels to report policy violations or security concerns, and procedures for handling violations, established and operating?
- Is there a working management cycle in which management is regularly briefed on security status and directs improvements?
Implementation guidance
- Issue a direction under management's name requiring all personnel to comply with the information security policy, and document and communicate the expectations and each person's responsibilities.
- Brief personnel on role-specific security responsibilities and rules of conduct from the point of hiring/contract/assignment, and confirm awareness through an acknowledgement or acceptance.
- Provide standing access to policies and procedures, and back compliance with the required knowledge and skills through education/training.
- Allocate resources (budget, staff, tools) for information security activities and treat security as a legitimate priority in management decisions.
- Establish channels to report policy violations or security issues without fear of reprisal, and define procedures for response and prevention of recurrence.
- Run a management cycle (such as management review) in which management is regularly briefed on security performance and issues and directs improvement.
Evidence
- Direction/announcement under management's name requiring compliance with information security (email, internal notice, and so on)
- Information security policy and records of distribution/acknowledgement by personnel
- Briefing materials and confirmation records on security responsibilities for new joiners/role changers
- Information security training plan and completion status
- Approval documents or management decision records for security budget/staff allocation
- Management review minutes and security status reports presented to management
Nonconformity examples
- An information security policy exists, but there is no record of management requiring, approving, or announcing compliance, so its effectiveness cannot be confirmed.
- There is no procedure to brief new joiners on their security responsibilities, so awareness varies from person to person.
- No budget or staff is allocated for security training, so planned training/activities go unperformed for a long time.
- Policy violations recur, but there is no action or direction for preventing recurrence at the management level.
- There is no channel to report security concerns or violations, or fear of disadvantage means it does not work in practice.
- With no reporting line to management, major security issues never reach top management.