ISO 27001 clause 5 expects top management to show real commitment to the ISMS, set an information security policy, and assign and communicate roles and responsibilities. It is not a task you can delegate away entirely. Auditors interview leaders to see whether they know the scope, the objectives and their own part.
The three parts of clause 5
According to a public guide to the standard, clause 5 has three sub-clauses:
- 5.1 Leadership and commitment. Top management, and line managers in relevant roles, must engage people in supporting the ISMS.
- 5.2 Policy. Top management establishes an information security policy that fits the organization's purpose, provides a framework for objectives, and includes commitments to meet requirements and to improve continually.
- 5.3 Roles, responsibilities and authorities. Top management ensures roles are assigned and communicated, so the ISMS meets the standard and its performance can be reported back to leadership.
What commitment looks like in records
Commitment is hard to audit as a feeling. It is easy to audit as evidence:
| Show | Evidence |
|---|---|
| Leaders set direction | A signed policy with a date and version |
| Leaders provide resources | Budget or headcount decisions in minutes |
| Leaders stay informed | Management review minutes with security metrics |
| Leaders communicate | An all hands note or training deck from a leader |
| Roles are clear | A roles list with names, communicated to staff |
For the review itself, see what to record in management review minutes.
What to prepare leaders for
An auditor may ask a founder or executive simple questions. What is the scope? What are our security objectives this year? Who owns risk acceptance? What did the last management review decide? Brief them in advance, in a page, using their own words where possible.
Writing a policy people will read
A one or two page policy that states purpose, scope, principles, roles and a commitment to improve is easier to follow than a long template. Leaders should be able to explain it in a sentence. Staff should know where it lives and how to ask questions.
Assigning roles in a small company
You do not need a department. You need names. List who owns the ISMS day to day, who owns risk decisions, who owns incident response and who owns supplier checks. One person may hold several roles, but the list should say so. If anyone holds a role by default and has not agreed to it, fix that before the audit.
Common gaps
- A policy signed once and never revisited.
- Leaders who cannot describe the scope.
- Roles that exist only in an org chart.
- No evidence that leadership discussed security results.
Quick check
Does the CEO have to be the top management?
Top management means the person or group that directs and controls the organization at the highest level. In a small company that usually includes the CEO. Confirm how your certification body reads it for your structure.
Can a consultant write the policy?
They can draft it, but top management must establish it and own it, and be able to explain it.
Safeguard's compliance automation can help assemble the records that show leadership engagement, such as review inputs. The commitment itself has to come from your leaders.
Sources
Last reviewed: 19 October 2026.
