Leadership and commitment

Current external reference: ISO/IEC 27001:2022

This is the 2022 clause a 2026 audit may use. It is not the 2020 layer and it is not the DIS text.

Top management has to show leadership of and commitment to the ISMS by: making sure the security policy and objectives exist and fit the organization's strategic direction; building ISMS requirements into business processes; making the needed resources available; communicating why effective security management and conformity with ISMS requirements matter; making sure the ISMS achieves what it is meant to; directing and supporting people to contribute to its effectiveness; promoting continual improvement; and supporting other managers in showing leadership in their own areas. A note explains that business can be read broadly as the activities core to the organization's existence.

How the 2020 guidance taught the audit

Auditors look for visible support, involvement and accountability of top management, which the row treats as critical to a successful ISMS. They confirm that top management has defined what it delegates and stays accountable for delegated work; sets the information security policy and objectives in line with the organization's strategic direction; communicates why effective information security management and conformance matter; supports every information security process, in particular by asking for and reviewing reports on ISMS status and effectiveness; directs and supports staff on ISMS matters; integrates the ISMS requirements into the organization's processes; makes resources available; assesses resource needs, reviews the effect of planned actions and sets improvement objectives in management review; and builds a culture that engages people in meeting ISMS requirements and objectives. Evidence comes from documents and from interviews with top management; management review results may cover most of the clause.

The DIS layer: the 2022 alignment

The DIS body and its annex numbering are not public. This is our reading of the public foreword and the 2022 clause record; where the public record is silent, the page says so.

No substantive change. Top management still has to take accountability, integrate the ISMS into business processes, provide resources and promote improvement.

Evidence an auditor asks for

• LeadershipInformation security policy and objectives approved by top management
• LeadershipManagement review minutes showing top management decisions on resources and improvement
• LeadershipResource needs assessments and budget approvals for the ISMS
• LeadershipCommunications from top management on the importance of information security
• LeadershipInterview notes with top management members

The questions an auditor will ask

Ask a top manager to explain a risk decision and the resource it changed. A policy signature is not evidence of commitment.

Common gaps

• Top management cannot describe the ISMS objectives or its own role in them
• Accountability delegated wholesale to the ISMS manager
• Resource requests raised in review with no decision recorded
• ISMS run as an IT project separate from business processes

Prepare before the next audit

Record the management decisions that shaped the ISMS in the last cycle, with the resource or risk consequence.

Cross-references

5.2 5.3