ISO 27001 Annex A 5.4 Management responsibilities for information security
What it says
Management shall require all personnel to apply information security in accordance with the established information security policy, topic-specific policies and procedures of the organization.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishManagers must ensure everyone follows and supports the organisation's security policies.
This control is all about making sure that everyone in the organisation knows and follows the rules for keeping information safe. It's essential because if people don't understand their responsibilities, sensitive information could be mishandled, leading to data breaches or other security incidents.
Free. Save your status, tasks and notes.
Why it matters
If managers don't enforce information security policies and procedures, staff may bypass required controls, increasing the likelihood of incidents and data breaches.
How to implement
The CEO or top management should clearly communicate the importance of information security to all staff.
This involves having a clear and easy-to-understand information security policy that is shared with everyone.
The HR department should ensure that information security responsibilities are included in job descriptions and employee contracts.
This means clearly outlining security duties so everyone knows what's expected when they start.
Managers should provide regular training sessions to keep staff informed about security policies.
Organise workshops or online courses, and make sure they're relevant to each person's role.
The IT team should ensure that all employees are equipped with necessary resources, like security software and tools, for maintaining information security.
This includes making sure everyone understands how to use them correctly.
Create and promote a confidential reporting process for staff to voice security concerns or report breaches.
Encourage an open environment where reporting is seen as a positive action that helps the organisation improve security.
Keep it running
Require managers to include policy compliance in onboarding, 1:1s and performance goals, and track adherence to information security and topic-specific procedures.
Evidence and audit
- Check 1 of 4What an auditor asks for
Ask for
To see the organisation's information security policy.
Look at
Clear communication of security roles and responsibilities. Good means it's comprehensive and easy to understand for all employees.
- Check 2 of 4What an auditor asks for
Ask for
Examples of job descriptions or employment contracts. Check for mentions of security responsibilities. Good indicates these documents clearly outline security expectations.
Look at
How frequently training is provided and the topics covered. Good evidence shows regular and relevant training for all staff.
- Check 3 of 4What an auditor asks for
Ask for
A list of tools and resources provided to staff for security purposes.
Look at
How these tools are distributed and maintained. Good means all necessary tools are up-to-date and staff are trained in their use.
- Check 4 of 4What an auditor asks for
Look at
Mentions of how this process is communicated to staff. Good is a well-publicised process that protects staff confidentiality.
Mappings
Closest match in ASD Information Security Manual: ISM-2105, Advise staff to limit posting work information on unauthorised online services, which this control covers in full and more.
ASD Information Security Manual: 13 mappings
This control is broader than ISM-2105.
ISM-2105 requires that personnel are advised about specific secure behaviour regarding posting work information to unauthorised online services and reporting it. ISO/IEC 27001:2022 Annex A 5.4 requires management to ensure personnel apply information security in accordance with established policies and procedures. ISM-2105 is one specific behaviour expectation that management would enforce under Annex A 5.4, while Annex A 5.4 is broader and not limited to online posting or reporting.
This control partially meets ISM-1998.
Annex A 5.4 requires management to require all personnel to apply information security in accordance with established policies and procedures. ISM-1998 requires the board or executive committee to ensure cyber security is integrated throughout all business functions, which is broader governance integration that encompasses (and enables) management enforcement of policy compliance. Annex A 5.4 is more specific to managerial direction and staff compliance behaviour, whereas ISM-1998 addresses enterprise-wide integration at the highest governance level.
This control partially overlaps ISM-0264.
Annex A 5.4 requires managers to ensure personnel apply information security according to established policies and procedures. ISM-0264 mandates developing, implementing and maintaining an email usage policy, which is a topic-specific policy that management would need to require personnel to follow. ISM-0264 is narrower (email-specific), while Annex A 5.4 applies across all information security policies and procedures.
This control partially overlaps ISM-1078.
Annex A 5.4 requires management to ensure personnel comply with the organisation's information security policies and procedures. ISM-1078 mandates a telephone system usage policy, which becomes a topic-specific rule set that management must enforce to achieve compliant behaviour. ISM-1078 is limited to telephone system usage, while Annex A 5.4 is broader and covers enforcement of all applicable policies.
This control partially overlaps ISM-1478.
Annex A 5.4 requires management to require personnel to apply information security in line with organisational policies and procedures. ISM-1478 requires the CISO to oversee the cyber security program and ensure compliance with policies, which includes monitoring and driving organisational adherence. ISM-1478 extends beyond personnel behaviour to program oversight, while Annex A 5.4 is about management requiring staff to follow established internal policies.
This control partially overlaps ISM-1602.
Annex A 5.4 requires management to ensure all personnel apply information security consistent with the organisation's policies and procedures. ISM-1602 requires that cyber security documentation (including changes) is communicated to all stakeholders, which directly contributes to personnel knowing what they must follow. ISM-1602 focuses on the communication/dissemination mechanism, whereas Annex A 5.4 focuses on management requiring and enforcing compliance once policies are established and communicated.
This control partially overlaps ISM-2001.
ISM-2001 requires the board or executive committee to champion a positive cyber security culture through visible leadership and example. Annex A 5.4 supports this by requiring management to ensure personnel apply information security in line with established policies and procedures. While Annex A 5.4 is more directive and compliance-oriented for managers, it ties into the leadership tone set by ISM-2001.
This control partially overlaps ISM-2004.
ISM-2004 requires board/executive support for developing cyber security skills and experience via awareness and training opportunities. ISO/IEC 27001:2022 Annex A 5.4 requires management to ensure personnel apply information security in accordance with policies and procedures. ISM-2004 supports Annex A 5.4 by building the awareness and competence needed for staff to follow policies consistently, but it does not itself impose the managerial enforcement requirement.
This control depends on ISM-0408.
ISM-0408 requires a security reminder banner at logon to prompt users about their responsibilities when accessing systems. Annex A 5.4 requires management to ensure personnel apply information security in accordance with organisational policies and procedures, and a logon banner is a practical mechanism to reinforce that expectation at each access attempt. The candidate is about managerial accountability and enforcement, while ISM-0408 is a specific technical/administrative control for user notification.
This control depends on ISM-0735.
ISM-0735 requires the CISO to oversee the development, implementation and maintenance of the organisation's cyber security awareness training program. That program is a primary means by which management communicates security expectations, so it directly supports Annex A 5.4, which requires management to ensure all personnel apply information security in line with the organisation's policies and procedures. Annex A 5.4 is broader, covering management's overall responsibility for policy compliance, while ISM-0735 addresses only CISO oversight of awareness training.
This control depends on ISM-1864.
ISM-1864 requires the organisation to establish and maintain a system usage policy. Annex A 5.4 supports this by placing responsibility on management to require personnel to apply information security in accordance with established policies and procedures, which is necessary to enforce ISM-1864 in practice. Annex A 5.4 is about managerial enforcement/accountability rather than defining the content of the usage policy itself.
This control depends on ISM-1865.
ISM-1865 requires personnel to agree to follow system usage policies before being granted access. Annex A 5.4 places responsibility on management to require all personnel to apply information security in accordance with policies and procedures, reinforcing organisational enforcement expectations once access is provided. Annex A 5.4 is broader and ongoing (management enforcement across the organisation), whereas ISM-1865 is a specific pre-access acknowledgement/condition.
This control depends on ISM-2074.
ISM-2074 requires an organisation to have a documented and maintained policy governing general-purpose AI usage. Annex A 5.4 requires management to ensure personnel apply information security in accordance with established policies and procedures, which is critical to making the AI usage policy enforceable in practice. Without management responsibility and direction (Annex A 5.4), implementing and sustaining compliance with ISM-2074's AI usage rules is unlikely to be effective.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.
Need this as a written policy?
PolicyMint drafts the ISO 27001 documentation this control expects, customised to your business and checked by three independent verifiers before you see it. Not a boilerplate template you have to fight into shape. First document free.
Draft your ISO 27001 documentation