SGRII Insights  ·  ISO 27001:2022  ·  2026

Signing the Information Security Policy Is Administration. ISO 27001 Clause 5 Requires Leadership. Most Boards Cannot Provide the Difference on Evidence.

Across certified ISMS implementations, top management commitment exists as a signed document. It rarely exists as demonstrated, evidenced governance. ISO 27001 auditors are specifically trained to find that gap — and increasingly, they are looking.

Ask an ISMS Manager who owns information security in their organisation. The answer is almost always: the ISMS Manager. Ask who sets the risk appetite. Almost always: the ISMS Manager, with informal agreement from the IT Director. Ask who made the last significant ISMS resource allocation decision. Almost always: IT budget process, with no specific information security framing. Then ask to see the management review record. Almost always: a presentation delivered by the ISMS Manager, received by a meeting, producing action items assigned to — the ISMS Manager.

This is not an ISMS with leadership commitment. It is an ISMS with a leadership proxy. And ISO/IEC 27001:2022 Clause 5 — specifically, deliberately, and in audit-consequential terms — requires something different.

What Clause 5 Actually Requires

Clause 5.1 requires top management to demonstrate commitment to the ISMS. The word ‘demonstrate’ is not decorative — it is an evidence obligation. The standard specifies the forms that demonstration must take: ensuring the information security policy and objectives are established and compatible with strategic direction; ensuring integration of ISMS requirements into business processes; ensuring adequate resources; communicating the importance of effective information security management; directing and supporting persons to contribute to ISMS effectiveness; promoting continual improvement; and supporting other relevant management roles to demonstrate leadership in their areas of responsibility.

Clause 5.2 requires top management to establish an information security policy that includes a commitment to satisfy applicable requirements and a commitment to continual improvement. Clause 5.3 requires that organisational roles, responsibilities, and authorities are assigned, communicated, and understood. Not assigned. Assigned, communicated, and understood — three distinct obligations, each with distinct evidence requirements.

The Five Evidence Gaps That Define Clause 5 Failure

Risk appetite without a decision record. The organisation’s information security risk appetite is documented. It is usually described as ‘Low to Medium.’ Ask who set it, when, and what decision process produced that characterisation. In most organisations: it was produced by the consultant who built the ISMS, approved by the IT Director, and has never been revisited. Risk appetite is a strategic leadership decision. It has direct implications for which risks are accepted, which controls are prioritised, and how much investment the ISMS receives. The absence of a board-level or equivalent decision record for risk appetite is a Clause 5.1 finding.

Management review without decisions. The management review record under Clause 9.3 is the primary mechanism through which top management’s ongoing ISMS commitment is evidenced. Most management review records contain: a summary of audit findings, an incident count, a training completion percentage, and action items. Very few contain: resource allocation decisions, scope changes, objective revisions, or formal risk acceptance records. A review that summarises data without producing governance decisions is a performance report, not a management review.

ISMS objectives without leadership ownership. Clause 6.2 requires that information security objectives are established at relevant functions and levels. In practice, objectives are documented. What is rarely evidenced is that those objectives were set by or ratified at leadership level, that progress is reported to leadership on a defined cycle, and that underperformance against objectives generates a leadership-level response. Objectives that exist in a register but never appear in a management meeting agenda are objectives that the leadership system does not own.

Resource decisions without ISMS framing. Clause 5.1(d) requires that top management ensures adequate resources are available. In most organisations, ISMS resource decisions occur through IT budget processes without an information security-specific framing. The question ‘what does the ISMS require to function effectively?’ is never formally put to leadership. The result is an ISMS that receives whatever resources remain after other IT priorities have been funded — and a Clause 5 obligation that has been administratively satisfied by the existence of a budget line.

Clause 5.3 understood by nobody but the ISMS Manager. Clause 5.3 requires that roles, responsibilities, and authorities are assigned, communicated, and understood. Most organisations can evidence assignment (a RACI or an organisational chart note). Very few can evidence that the assignment has been communicated in a way that the assigned parties understand what their ISMS responsibilities are — particularly for non-IT roles. Ask the Head of HR what their information security responsibilities are. Ask the CFO what they are required to do under the ISMS. The quality of those answers is Clause 5.3 evidence.

What the Standard Requires as Evidence — Clause 5 Specifically

Clause 5.1 evidence is demonstrated through records, not documents. The information security policy is one artefact. The management review record, the resource allocation decisions, the risk appetite approval, and the objective progress reporting are the evidence of leadership commitment. If these documents exist only as ISMS Manager outputs presented to leadership — rather than as leadership decisions and direction — the standard’s demonstration requirement has not been satisfied.

Clause 5.3 evidence requires more than an organisational chart. It requires demonstration that the people assigned to ISMS roles understand those roles. In a Stage 2 audit, auditors will ask individuals — not just the ISMS Manager — about their information security responsibilities. The CISO who cannot articulate their Clause 5.3 obligations, the IT Manager who does not know they are responsible for control implementation evidence, the HR Director who has never seen the personnel security procedure — these are Clause 5.3 findings.

Why Leadership Commitment Remains the Industry’s Most Widespread Structural Gap

The ISO 27001 certification process does not structurally require a board-level interview. Stage 1 audits focus on document review. Stage 2 audits focus primarily on the ISMS Manager and ISMS documentation. Unless an auditor specifically schedules and conducts a top management interview — which not all do — the gap between nominal and genuine leadership commitment can survive certification.

The result is a global population of certified ISMS implementations where information security governance sits, functionally, with IT or the ISMS Manager — and top management involvement is satisfied by an annual signature and an annual management review attendance. The standard requires neither of these things as its primary evidence. It requires demonstrated, active, evidenced commitment. The certification process frequently accepts less.

The SGRII Position

The Governance pillar in the SGRII framework is unambiguous: information security governance is a leadership obligation, not an IT function. THE SGRII ISO 27001:2022 ISMS FRAMEWORK is built around this principle. The ISMS Governance Charter defines top management obligations with specificity — not as generic commitment language, but as accountable, evidenced actions with review cycles. The Management Review Record is structured as a decision forum, not a reporting template: mandatory inputs produce mandatory governance decisions, not summaries.

The Risk Appetite Statement template is designed for leadership ratification, with a documented approval authority and a defined review trigger. The ISMS Objectives Framework requires leadership sign-off on objectives and progress reporting at a level that makes leadership accountability visible. And the Clause 5.3 Responsibility Matrix includes a communication record structure — not just assignment, but documented communication and awareness verification — for all information security roles, including non-IT leadership positions.