ISO 27001 Clause 5 — Leadership
What the standard requires of top management: demonstrated commitment, a policy, and roles that are assigned and communicated
Clause 5 is short, and every sentence in it names top management. That is deliberate. The standard is explicit that an ISMS cannot be delegated wholesale to a security function — and clause 5 is where auditors test whether it has been.
Three sub-clauses: what leadership has to demonstrate, what the policy has to say, and who holds which responsibilities. None of them can be satisfied by a document alone.
The sub-clauses
5.1 — Leadership and commitment
Eight specific obligations for top management, from aligning objectives with strategy to supporting other management roles in their own areas.
5.2 — Policy
Four things the information security policy must include, and three things that must be true of it once written.
5.3 — Organizational roles, responsibilities and authorities
Assign and communicate information security roles — including two responsibilities the standard names explicitly.
How clause 5 is actually tested
By interview, mostly. An auditor talks to top management directly and asks what the ISMS is for, what the objectives are and what decisions they have taken about it. They then trace one of those decisions to see what happened.
The other test is integration. Clause 5.1(b) requires ISMS requirements to be integrated into the organisation’s processes — so an auditor looks at procurement, change and onboarding to see whether security lives inside them or beside them. A parallel security process that everyone bypasses under deadline pressure is a clause 5 finding, not a clause 8 one.
The most common failures
Leadership delegated entirely to the ISMS manager. A signed policy treated as the whole of clause 5. Resources promised and never released, which shows up as a treatment plan that never moves. Management review held as a formality that produces no decisions. And the two responsibilities named in 5.3 — conformity, and reporting performance to top management — left implicit because “everyone knows whose job it is”.
Each of these is visible from outside. None of them is fixed by writing another document.
What changed in the 2022 edition
Clause 5 is essentially unchanged from the 2013 edition. The eight leadership obligations, the policy requirements and the role assignments all carry over.
The one addition is a note in 5.3 confirming that top management can also assign responsibility for reporting ISMS performance within the organisation, not only upward. It is a clarification, not a new requirement.
Frequently asked questions
Who counts as top management?
The people who direct and control the organisation at the highest level within the ISMS scope. In a group, this can be the leadership of the scoped entity rather than the global board — provided that level genuinely controls resources and direction.
Do we still need a management representative?
No. That requirement was dropped. What remains is clause 5.3: the responsibility for conformity and for reporting performance must be assigned to identified people.
Does clause 5 require documented information?
Only the policy, under 5.2. But leadership leaves traces in documents other clauses require — objectives, management review records, role assignments — and that is where it is evidenced.
How long should the information security policy be?
The standard sets no length. One to three pages is typical, with detail pushed into topic-specific policies below it.
Management engagement is the most common reason an implementation stalls. The Lead Implementer course deals with how to get it and keep it. Contact us to talk through your situation.
Where this sits
This page explains the requirement in our own words, for study and orientation. It is not a substitute for the standard: the authoritative text is ISO/IEC 27001:2022, available from ISO and from national standards bodies.
