ISO 27001:2022 Annex A 5.4 – Management Responsibilities

• See ISO 27002:2022 Control 5.4 for more information.
• See ISO 27001:2013 Annex A 7.2.1 for more information.

Ensuring Compliance: Management’s Guide to ISO 27001 Control 5.4

ISO 27001:2022, Annex A control 5.4, Management Responsibilities covers the need for management to ensure that all personnel stick to all the information security topic-specific policies and procedures as defined in the established information security policy of the organisation.

What Is ISO 27001:2022 Annex A 5.4 Management Responsibilities?

Employees and contractors should be aware of and fulfil their information security responsibilities as described in this Annex.

Annex A Control 5.4 describes how employees and contractors apply information security per the organisation’s policies and procedures.

The responsibilities placed upon managers should include requirements to:

• They must understand the information security threats, vulnerabilities, and controls relevant to their job roles and receive regular training (as outlined in Annex A 7.2.2).
• Reinforce the requirements of the terms and conditions of employment by ensuring buy-in to proactive and adequate support for applicable information security policies and controls in Annex A.

It is the responsibility of managers to ensure that security awareness and conscientiousness permeate the entire organisation and to establish an appropriate “security culture.”

Information Security Policies – What Are They?

An information security policy is a formal document that provides management direction, goals and principles for protecting an organisation’s information. To ensure the allocation of resources appropriately, an effective information security policy needs to be tailored to an organisation’s specific needs and supported by senior management.

It specifies how the company will protect its information assets and how employees should handle sensitive data.

Most information security policies are developed by senior management in conjunction with IT security staff and are derived from laws, regulations, and best practices.

A framework for defining roles and responsibilities and a review period should also be included in policies.

Why Is ISO 27001:2022 Annex A 5.4 Significant?

Annex A Control 5.4 aims to ensure that management is aware of their responsibilities for information security.

It takes steps to ensure that all employees are aware of those responsibilities.

How Annex A 5.4 Works

Information is a valuable asset that must be protected against loss, damage, or misuse. Management must ensure that adequate measures are taken to protect this asset. To achieve this, management must ensure that all personnel adhere to the organisation’s information security policies, topical policies, and procedures.

Control 5.4 in Annex A defines management responsibility regarding information security in an organisation based on ISO 27001’s framework.

Management must be on board with the information security programme, and all employees and contractors must be aware of the information security policy and follow it. Security policies, topic-specific policies, and procedures should never be exempt from mandatory compliance by any employee or contractor.

The Process of Annex A 5.4 and What to Expect

An organisation’s information security policies, standards, and procedures must be enforced by management to comply with this Annex A control.

Getting management’s support and buy-in is the first step.

To demonstrate commitment, management must follow all its policies and procedures. For example, if security awareness training is required annually, managers should complete those courses themselves.

Regardless of their position, everyone in the company must be aware of the importance of information security. As stated in the company’s ISMS programme, everyone must understand their role in maintaining the security of sensitive data. This includes the board of directors, executives and managers, and employees.

What Are the Changes and Differences From ISO 27001:2013?

ISO 27001:2022 Annex A 5.4 Management Responsibilities was previously known as Control 7.2.1 Management Responsibilities. It is not a newly added control but a more robust interpretation of the corresponding control in ISO 27001:2013.

There are a few differences between Annex A, control 5.4 and control 7.2.1. These differences are documented in the implementation guidance for both.

ISO 27001 Implementation Guidelines Comparison for Annex A 5.4

It is the responsibility of management to ensure that employees and contractors follow the following standards:

• Before accessing confidential information or information systems, employees are adequately trained in information security roles and responsibilities.
• Provide guidelines for stating the information security expectations of their role within the organisation.

An organisation must:

• Be motivated to ensure that the organisation’s information security policies are followed.
• Be familiar with their roles and responsibilities in terms of information security.
• Comply with the organisation’s information security policy and appropriate working methods.
• Ensure employees have the appropriate skills and qualifications and receive regular training.
• Reporting violations of information security policies or procedures can be done anonymously (“whistleblowing”).

Management should support information security policies, procedures, and Annex A controls.

Control 5.4 of Annex A is more user-friendly and requires that management ensures that employees and contractors follow the following guidelines:

A) Are informed of their responsibilities and roles in information security before access is granted to the organisation’s information.

B) Receive guidelines that specify the expected level of information security in their specific roles.

C) Fulfill the organisation’s information security policy and topic-specific policies.

D) Become aware of their role and responsibilities concerning information security.

E) Adherence to workplace rules, including the organisation’s data security policy and methods of working.

F) Continually educate yourself on information security skills and qualifications.

G) In cases of violations of information security policies, topic-specific policies or procedures (“whistleblowing”), employees should be provided with a confidential channel of communication. An anonymous reporting option or provisions ensuring that the identity of the reporter is only known to those who need to deal with these reports are possible.

H) Ensure adequate resources and project planning time to implement security-related processes and Annex A controls.

The ISO 27001:2022 standard explicitly demands that workers and contractors have access to the necessary resources and project planning time to implement security-related procedures and controls.

ISO 27001:2013 and ISO 27001:2022 use different wording for some implementation guidelines. For example, guideline C in 2013 states that employees and contractors should be ‘motivated’ to adopt ISMS policies; however, in 2022, the word ‘mandated’ is used.

Table of All ISO 27001:2022 Annex A Controls

In the table below you’ll find more information on each individual ISO 27001:2022 Annex A Control.

How Is This Process Managed?

Simply put, a company’s management ensures that an ISMS (Information Security Management System) is in place.

An information security manager who is qualified, experienced, and responsible for developing, implementing, managing, and continuously improving the ISMS should be appointed.

ISMS.online: How We Can Help

When implementing an ISO 27001-aligned ISMS, a key challenge is keeping track of your information security controls. Our system makes this process simple.

Our team understands the importance of protecting your organisation’s data and reputation. Consequently, our cloud-based platform simplifies the implementation of ISO 27001, enables you to establish a robust framework for information security controls, and helps you achieve certification quickly and easily.

Using ISMS.online, you can rapidly obtain ISO 27001 certification and manage it afterwards. Our platform has various user-friendly features and toolkits that will save you time and ensure you’re creating a robust ISMS.

Contact us today to schedule a demo.