Clause 5.1 Leadership and commitment
Clause 5.1 in ISO 27001:2022 (ISO/IEC 27001:2022). All ISO 27001:2022 controls held. Open ISO 27001:2022 on the standards site.
The control as we hold it
Leadership and commitment. Top management has to show leadership of and commitment to the ISMS by: making sure the security policy and objectives exist and fit the organization's strategic direction; building ISMS requirements into business processes; making the needed resources available; communicating why effective security management and conformity with ISMS requirements matter; making sure the ISMS achieves what it is meant to; directing and supporting people to contribute to its effectiveness; promoting continual improvement; and supporting other managers in showing leadership in their own areas. A note explains that business can be read broadly as the activities core to the organization's existence.
Reviewed and closest counterparts in the other frameworks
We hold no cross-framework row for Clause 5.1 yet. The reviewed pairs page lists the released pairs and their coverage.
What an auditor commonly asks for
General guidance for this control area (domain: Clause 5), in our words, not a statement of the standard and not binding on an assessor.
- Board or executive minutes approving the security policy and objectives and showing their alignment with strategy
- Budget and resource approvals for the ISMS
- Communications from top management about the importance of information security
- Evidence of ISMS requirements embedded in business processes, such as security steps in procurement or project approval
- Records of top management participation in management reviews and improvement decisions