ISO/IEC 27001:2022 clause 5.1, Leadership and commitment, requires top management to demonstrate leadership of the information security management system (ISMS). In practice that means setting a policy and objectives that fit the strategy, building the ISMS into business processes, providing resources, communicating its importance, directing people and promoting continual improvement.
What does ISO 27001 clause 5.1 require?
Clause 5.1 says top management must show leadership and commitment to the ISMS by:
- a) Policy and objectives: making sure an information security policy and information security objectives are set and fit the organisation’s strategic direction.
- b) Integration: making sure the ISMS requirements are built into the organisation’s own processes.
- c) Resources: making sure the resources the ISMS needs are available.
- d) Communication: telling people why effective information security management matters, and why following the ISMS requirements matters.
- e) Outcomes: making sure the ISMS achieves what it is meant to achieve.
- f) People: directing and supporting people so they contribute to an effective ISMS.
- g) Improvement: promoting continual improvement.
- h) Other managers: supporting other relevant managers to show leadership in their own areas of responsibility.
A note to the clause explains that “business” can be read broadly, as the activities core to why the organisation exists, so the clause applies to charities and public bodies as well as companies. This page explains what the clause asks for; for step-by-step guidance on putting it in place, see how to implement clause 5.1 leadership and commitment.
Security is believable when leadership doesn’t just approve policy, but steers the conversations, resources and priorities that bring protection into daily business.
What is the role of top management in ISO 27001?
Top management is the senior group that runs the organisation, such as the board, chief executive or executive team. Under ISO 27001:2022 it must demonstrate leadership of the ISMS (clause 5.1), set the information security policy (clause 5.2), make sure security roles are assigned and communicated (clause 5.3) and review the ISMS at planned intervals (clause 9.3).
Clause 5.3 requires top management to assign the responsibility and authority for making sure the ISMS meets the standard and for reporting on its performance. The duty to show leadership and commitment under clause 5.1 still sits with top management. Clause 9.3 also requires documented information as evidence of the results of management reviews, which is often where that leadership is easiest to see.
Leadership shows in the decisions top management takes during the year, not only in the signatures on documents.
A common weakness is a leadership team that signs the policy and then steps back until the certification audit, leaving the ISMS manager without decisions, budget or authority. Keeping leadership involved in review cycles, budget decisions and changes to the business all year avoids that gap.
ISO 27001 made easy
An 81% Headstart from day one
We’ve done the hard work for you, giving you an 81% Headstart from the moment you log on. All you have to do is fill in the blanks.
How do you demonstrate leadership commitment for ISO 27001?
You demonstrate it with records that show top management acting on each point of clause 5.1, kept up to date through the year. The table below gives examples of evidence an auditor or customer doing due diligence may ask to see. The owners are typical examples; your own structure may differ.
| Clause 5.1 point | Example evidence | Typical owner |
|---|---|---|
| a) Policy and objectives fit the strategy | Approved information security policy; objectives discussed alongside business plans in board or management review minutes | Board or chief executive |
| b) ISMS built into processes | Security steps in procurement, onboarding, change and project approvals | Executive owner of each process |
| c) Resources available | Approved budget lines, staffing decisions and training plans | Finance director or executive team |
| d) Importance communicated | Messages from the chief executive or directors, all-staff briefings, intranet posts | Chief executive or directors |
| e) ISMS achieves its outcomes | Management review records with performance results and decisions (clause 9.3) | Top management, supported by the ISMS manager |
| f) People directed and supported | Named roles and responsibilities (clause 5.3), training and awareness records | Directors and line managers |
| g) Continual improvement promoted | Improvement actions agreed at management review and tracked to closure | Top management with the ISMS manager |
| h) Other managers supported | Department heads with their own security objectives; delegated responsibilities on record | Executive team and department heads |
The strongest evidence is consistent: board minutes, management reviews, budget approvals and leadership messages that tell the same story about priorities and decisions.
A single approval is proof for a day; regular, recorded participation shows a pattern across the year.
If leadership talks about security but every action stops with the IT team, the gap shows quickly. ISMS.online customers record leadership activity across these points, so the evidence is in one place.
How do you turn leadership commitment into day-to-day accountability?
The gap between policy and proof closes when leadership accountability is part of normal operations, by naming, tracking and reviewing each action and outcome. Organisations that do this well:
- Write down executive responsibilities person by person, with explicit owners rather than vague sign-offs.
- Map accountability across departments with a responsibility (RACI) matrix and a clear organisation chart.
- Run executive-led committees or steering groups where scorecards, metrics and incident response stay on the leadership’s agenda.
- Build regular review loops: management confirmations, scheduled self-assessments and routine cross-checks.
Security teams use ISMS.online to capture and show leadership’s decisions in one place, so the record survives when people change roles.
Accountability that is owned, not merely cited, keeps your ISMS ready between audits.
Which leadership habits keep clause 5.1 evidence current?
They make security a regular part of running the business:
- Put information security on the board agenda as a standing item, so it gets executive input at every meeting.
- Link business KPIs and results to ISMS performance, tightening the connection between performance and resilience.
- Involve leadership in every major ISMS change, so each material decision carries a named approver.
- Have directors or the chief executive publicly recognise security champions across the organisation.
- Respond quickly when incidents or resource problems arise, so leadership is seen acting, not just signing off.
Security culture flows from the top; when executives act, the organisation follows.
ISMS.online helps make these habits practical on busy schedules, with reminders and recorded evidence so nothing is missed.
What happens if leadership commitment stays on paper?
If leadership commitment exists only in a signed document, the risk goes beyond a certification audit. An auditor or customer doing due diligence may look for signs that top management takes part in decisions, and gaps in that evidence can raise questions about how the ISMS is run. Teams that keep a record of real executive involvement are better placed to show the ISMS is working.
Paper promises fold; visible action builds resilience across your culture and with your partners.
Manage all your compliance, all in one place
ISMS.online supports over 100 standards and regulations, giving you a single platform for all your compliance needs.
Why choose ISMS.online for ISO 27001 clause 5.1?
ISMS.online helps compliance officers, CISOs and chief executives turn leadership intent into recorded action. It helps you:
- Record key executive actions, such as policy approvals, ISMS reviews, risk sign-offs and resource assignments.
- Keep a history of who did what and when, which stays in place when teams change.
- Bring leadership evidence together with management review features and dashboards.
- Assign tasks, log decisions and see who is accountable for each one.
- Name owners, record reviews and send reminders so nothing is missed.
- Keep leadership’s decisions in one place, ready to show auditors, partners and customers.
Certificates are issued by accredited certification bodies; ISMS.online helps you prepare for and achieve certification. To see how it can help your leadership team show its commitment, book a demo.
Frequently Asked Questions
How does clause 5.1 in ISO 27001:2022 differ from the 2013 version?
The eight points in clause 5.1 read the same in ISO/IEC 27001:2022 as in ISO/IEC 27001:2013. Top management still has to demonstrate leadership and commitment through the policy, integration, resources, communication, outcomes, people, improvement and support for other managers. The 2022 edition adds a short note on how to read the word “business”.
If you held a 2013 certificate, your clause 5.1 evidence should still apply; the bigger changes in the 2022 edition sit elsewhere in the standard.
Proactive leadership isn’t about one big gesture; it is how everyday decisions shape the security culture.
Is a signed information security policy enough to show leadership commitment?
No. Approving the policy covers only part of the first of the eight points in clause 5.1. The clause also covers objectives, building the ISMS into processes, resources, communication, outcomes, directing people, improvement and supporting other managers. A policy signature alone says little about whether top management is involved in the rest.
Can top management hand clause 5.1 over to the CISO or ISMS manager?
Not entirely. Clause 5.1, however, is written as a duty of top management itself, so leadership and commitment cannot be passed on in full.
- Build a responsibility matrix that links each ISMS activity to a named executive and the people supporting them.
- Record each review, approval and risk decision with the owner and date.
- Set reminders for reviews so accountability does not lapse between cycles.
Ownership is proven by who acts, not who appears first on an organisation chart.
How do you restart leadership involvement if it has lapsed?
Start with an honest check of where leadership involvement has dropped away, then put it back on a fixed schedule. Compare recent board and management activity against each point of clause 5.1, using real examples rather than statements of intent, and agree recurring dates for reviews, sign-offs and senior check-ins.
- Run a self-assessment against clause 5.1 using recent examples.
- Put risk reviews, resource sign-offs and senior management check-ins in the diary as recurring meetings.
- Use ISMS.online to assign owners by name, record reviews and send reminders so nothing is missed.
- Share leadership’s ISMS decisions and progress with staff and stakeholders.
How does clause 5.1 relate to Annex A control 5.4 Management responsibilities?
They work at different levels. Clause 5.1 is a requirement on top management to lead the ISMS as a whole. Annex A control 5.4, Management responsibilities, is a control that asks management to require all personnel to apply information security in line with the organisation’s policy, topic-specific policies and procedures.
In practice, clause 5.1 sets the direction from the top, and control 5.4 carries it into how managers lead their own teams day to day. Evidence for one often supports the other, such as leadership messages and awareness records.
What are the risks if leadership only “shows up” for audit season?
When leadership appears only around audits, the ISMS tends to drift between them: risks wait for a decision, resources lag behind needs and staff see security as a once-a-year exercise. That weakens trust with customers and partners and can put certification at risk when gaps surface.
- Problems are more likely to be found and fixed early when leadership is involved in regular reviews.
- Risks can be dealt with before they turn into incidents, which builds board and stakeholder confidence.
- Responses to new threats are faster when leaders already own the decisions.
When executive action is routine, an audit becomes a chance to show how the organisation already works rather than a scramble.
