5.4 Management responsibilities
Managers are to insist that everyone working for the organization applies information security as the organization's policy, topic-specific policies and procedures lay down. Purpose: make sure managers grasp their own part in information security and act so that all staff know and carry out their security duties. Guidance: management shows visible backing for the policies, procedures and controls. Its duties include making sure people are briefed on their security role before they receive access to information and assets; are given written expectations for their role; are required to follow the policies; reach a level of awareness that matches their role (see 6.3); keep to the security terms of their employment contract or agreement and the expected ways of working; maintain the right security skills and qualifications through continuing education; have, where practical, a confidential route for reporting breaches of policy or procedure (whistleblowing), which may be anonymous or restrict knowledge of the reporter's identity to those handling the report; and are given enough resources and planning time to implement the security processes and controls.
Source: ISO/IEC 27002:2022, 5.4. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27002:2022 in the compliance library.
ISO/IEC 27002 is guidance on the Annex A controls; certification is against ISO/IEC 27001. Use this set when your sheet follows the 27002 numbering.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Evidence that security briefings on roles and responsibilities occur before access is granted, such as onboarding checklists tied to access provisioning · Identity provider / directory
- Records of continuing professional education for staff in security-relevant roles · Identity provider / directory
governing documentDocuments that govern the control
- Role-specific guidance documents setting out security expectations · Policy repository / GRC workspace
- Signed employment contracts or agreements containing the security obligations · Vendor register / contract repository
- A confidential or anonymous reporting channel for policy violations with its handling procedure · Policy repository / GRC workspace
- Project plans or budgets showing resources and time allocated to security processes and controls · Policy repository / GRC workspace
First move
Common gaps auditors find
- Access is provisioned before any security briefing takes place
- No confidential route exists for reporting violations, or reporters' identities are not protected
- Managers do not visibly endorse the policies, so compliance is seen as the security team's concern
- Security work is expected without any allocated time or resource in project plans
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet