5.4 Management responsibilities
Requires management to compel all personnel to apply information security in accordance with the organisation's established policy, its topic specific policies and its procedures, rather than leaving adherence to individ
5
artefacts
1
held by a system
2
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Records showing management assign security tasks and follow up on completion · Policy repository / GRC workspace
periodic reviewEvidence produced at each review
- Evidence of management action where adherence was found lacking, and the route from that to the disciplinary process · HR system / LMS
- Management review minutes covering information security performance · Policy repository / GRC workspace
governing documentDocuments that govern the control
- Evidence that management sets the expectation that personnel apply the policy and procedures, such as briefings, team meeting records or management communications · Policy repository / GRC workspace
- Objectives or performance measures for managers that include security responsibilities · Policy repository / GRC workspace
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your Policy repository / GRC workspace on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Policy issued centrally with no evidence any line manager reinforced it
- Non-adherence identified by audit or monitoring with no record of management follow up
- Management review held but minuted at a level that shows no decision was taken
- Expectations set for employees only, with contractors and outsourced staff left to their own employer
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet