Control A.5.4Management responsibilities
What it means in practice
Management must require all personnel to apply information security in accordance with the established policy, topic-specific policies and procedures of the organisation.
The control is aimed at the layer between top management’s commitment in clause 5.1 and the individual’s awareness in clause 7.3: line managers, who decide in practice whether security requirements are treated as real.
It is the control that makes the difference between a policy that is enforced and one that is available. Where a manager permits a shortcut — shared credentials to meet a deadline, an approval skipped during a busy period — the policy is intact and the control is not.
Evidence is indirect and behavioural: whether security objectives feature in what managers are measured on, whether exceptions are escalated or absorbed, and whether the disciplinary process in A.6.4 has ever been applied. An organisation where no security requirement has ever been enforced against anybody is describing its culture whether it means to or not.
How to put this in place
Policies only work if managers expect their teams to follow them. In an ISMS project this control is what turns approved documents into daily management behaviour.
- Decide what managers must ensure for their teams, such as training completed and access reviewed.
- Add those duties to manager role descriptions and objectives.
- Give managers simple figures for their own team, such as training completion and open access reviews.
- Raise non-adherence through the normal management line and record what was done.
- Report the results to top management in the management review.
Evidence an auditor usually looks for: management communications on security, objectives or appraisals that mention it, and examples of managers acting on training or access review results.
What is in the packs for this
Each one helps with this requirement.
- Excel
Annex A Control Implementation Library
in ISO 27001 Implementation & Certification ReadinessIts row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies. - Excel
Statement of Applicability Template
in ISO 27001 Implementation & Certification ReadinessHas its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented. - Excel
Policy Development & Approval Responsibility Matrix
in Security Policy ManagementIts Framework References list this control. Supported by: Approval rows PD-06 to PD-09; quarterly report PD-18. - Word
Management Body Cybersecurity Accountability Record
in NIS2 Implementation & ReadinessIts Framework References list this control. Supported by: Part D: management requiring the measures to be applied, and following up.