A.5.4ISO 27001Last reviewed 19 February 2026

ISO 27001 A.5.4: Management responsibilities

Security policies are only worth the paper they are printed on if management actually enforces them. Publishing a policy and hoping for compliance is not enough - managers at every level need to actively drive adherence and, critically, lead by example.

Work through the ISO 27001 assessment, record supporting evidence and review the gaps in your answers.

Start my free ISO 27001 assessmentNo account · No credit card · Save when useful

Requirement summary

Management shall require all personnel to apply information security in accordance with the established information security policy and topic-specific policies and procedures of the organization.

Check the source wording and scope in ISO/IEC 27001:2022. The guidance below explains how to approach a review.

In Plain Language

This means ensuring that staff receive proper security awareness training, understand their individual obligations, and have the resources they need to do the right thing. Managers also need to monitor compliance within their teams and act when violations occur - not look the other way.

This does not stop at permanent employees. Contractors, temporary staff, and any third-party personnel accessing your information need to understand and agree to your security requirements before they get access. Management is responsible for making that happen.

How to Implement

Build a clear management accountability framework for security. Define what is expected of managers at each level - from first-line supervisors to senior executives - and build these expectations into their performance objectives and evaluations.

Run a mandatory security awareness programme that everyone must complete before getting access to information systems. Cover your security policies, acceptable use requirements, incident reporting procedures, and what happens when people do not comply. Track completion rates and chase up anyone who has not finished.

Create a proper new joiner process that includes security induction, policy sign-off, confidentiality agreements, and acknowledgement of responsibilities. This applies equally to contractors and temps. Give managers a checklist to work through for each new team member.

Give managers the tools to monitor compliance - regular spot checks, access log reviews, participation in audits. Dashboards or periodic reports showing compliance metrics for their area are useful here.

Establish a clear, fair, documented disciplinary process for policy violations and make sure managers know how to use it. Equally important: recognise and reward good security behaviour. A positive security culture is far more effective than a punitive one.

Evidence to review

Security awareness training records showing management enforcement of completion
Signed confidentiality and acceptable use agreements for all personnel
Management performance objectives that include information security responsibilities
Records of management actions taken to address security non-compliance
New joiner security induction checklist and completion records

Common Mistakes

Management does not lead by example and bypasses security controls themselves
Security awareness training is optional or not tracked for completion
Contractors and temporary staff are not included in security awareness programs
No consequences for repeated policy violations leading to a culture of non-compliance
Managers are unaware of their specific security oversight responsibilities

Related Controls Across Frameworks

Framework	Control ID	Relationship
SOC 2	SOC 2 CC1.4: COSO Principle 4: Demonstrates Commitment to Attract, Develop, and Retain Competent Individuals	Related
SOC 2	SOC 2 CC2.2: COSO Principle 14: Internally Communicates Information	Related
GDPR	GDPR Art.39: Tasks of the Data Protection Officer	Partial overlap
NIS2	NIS2 Art.20(1): Management Body Accountability and Governance	Related

Frequently Asked Questions

What happens when senior management does not support information security?

Bluntly, everything falls apart. If management does not visibly back security, staff will not take it seriously, budgets will be inadequate, and policies will be ignored. This is one of the most critical findings an auditor can raise because it undermines the entire ISMS. ISO 27001 Clause 5 explicitly requires top management commitment - it is not optional.

How should management handle security policy violations?

Follow a documented, proportionate disciplinary process. A minor first-time slip might just need a conversation and some additional training. Repeated or serious violations need formal disciplinary action. The important things are consistency, fairness, and documentation. Make sure everyone knows the process before they need it - no one should be surprised by the consequences.

Track ISO 27001 compliance in one place

Work through the ISO 27001 assessment, record supporting evidence and review the gaps in your answers.

Start Free Assessment

Start without an account · Sign up only to save

Start my free ISO 27001 assessment