ISO 27001:2022 Annex A Control 5.4

Why Is ISO 27001:2022 Annex A 5.4 Significant?

Annex A Control 5.4 aims to ensure that management is aware of their responsibilities for information security.

It takes steps to ensure that all employees are aware of those responsibilities.

How Annex A 5.4 Works

Information is a valuable asset that must be protected against loss, damage, or misuse. Management must ensure that adequate measures are taken to protect this asset. To achieve this, management must ensure that all personnel adhere to the organisation’s information security policies, topical policies, and procedures.

Control 5.4 in Annex A defines management responsibility regarding information security in an organisation based on ISO 27001’s framework.

Management must be on board with the information security programme, and all employees and contractors must be aware of the information security policy and follow it. Security policies, topic-specific policies, and procedures should never be exempt from mandatory compliance by any employee or contractor.

The Process of Annex A 5.4 and What to Expect

An organisation’s information security policies, standards, and procedures must be enforced by management to comply with this Annex A control.

Getting management’s support and buy-in is the first step.

To demonstrate commitment, management must follow all its policies and procedures. For example, if security awareness training is required annually, managers should complete those courses themselves.

Regardless of their position, everyone in the company must be aware of the importance of information security. As stated in the company’s ISMS programme, everyone must understand their role in maintaining the security of sensitive data. This includes the board of directors, executives and managers, and employees.

What Are the Changes and Differences From ISO 27001:2013?

ISO 27001:2022 Annex A 5.4 Management Responsibilities was previously known as Control 7.2.1 Management Responsibilities. It is not a newly added control but a more robust interpretation of the corresponding control in ISO 27001:2013.

There are a few differences between Annex A, control 5.4 and control 7.2.1. These differences are documented in the implementation guidance for both.

ISO 27001 Implementation Guidelines Comparison for Annex A 5.4

It is the responsibility of management to ensure that employees and contractors follow the following standards:

• Before accessing confidential information or information systems, employees are adequately trained in information security roles and responsibilities.
• Provide guidelines for stating the information security expectations of their role within the organisation.

An organisation must:

• Be motivated to ensure that the organisation’s information security policies are followed.
• Be familiar with their roles and responsibilities in terms of information security.
• Comply with the organisation’s information security policy and appropriate working methods.
• Ensure employees have the appropriate skills and qualifications and receive regular training.
• Reporting violations of information security policies or procedures can be done anonymously (“whistleblowing”).

Management should support information security policies, procedures, and Annex A controls.

Control 5.4 of Annex A is more user-friendly and requires that management ensures that employees and contractors follow the following guidelines:

A) Are informed of their responsibilities and roles in information security before access is granted to the organisation’s information.

B) Receive guidelines that specify the expected level of information security in their specific roles.

C) Fulfill the organisation’s information security policy and topic-specific policies.

D) Become aware of their role and responsibilities concerning information security.

E) Adherence to workplace rules, including the organisation’s data security policy and methods of working.

F) Continually educate yourself on information security skills and qualifications.

G) In cases of violations of information security policies, topic-specific policies or procedures (“whistleblowing”), employees should be provided with a confidential channel of communication. An anonymous reporting option or provisions ensuring that the identity of the reporter is only known to those who need to deal with these reports are possible.

H) Ensure adequate resources and project planning time to implement security-related processes and Annex A controls.

The ISO 27001:2022 standard explicitly demands that workers and contractors have access to the necessary resources and project planning time to implement security-related procedures and controls.

ISO 27001:2013 and ISO 27001:2022 use different wording for some implementation guidelines. For example, guideline C in 2013 states that employees and contractors should be ‘motivated’ to adopt ISMS policies; however, in 2022, the word ‘mandated’ is used.

Table of All ISO 27001:2022 Annex A Controls

In the table below you’ll find more information on each individual ISO 27001:2022 Annex A Control.

How Is This Process Managed?

Simply put, a company’s management ensures that an ISMS (Information Security Management System) is in place.

An information security manager who is qualified, experienced, and responsible for developing, implementing, managing, and continuously improving the ISMS should be appointed.

ISMS.online: How We Can Help

When implementing an ISO 27001-aligned ISMS, a key challenge is keeping track of your information security controls. Our system makes this process simple.

Our team understands the importance of protecting your organisation’s data and reputation. Consequently, our cloud-based platform simplifies the implementation of ISO 27001, enables you to establish a robust framework for information security controls, and helps you achieve certification quickly and easily.

Using ISMS.online, you can rapidly obtain ISO 27001 certification and manage it afterwards. Our platform has various user-friendly features and toolkits that will save you time and ensure you’re creating a robust ISMS.

Contact us today to schedule a demo.