Management responsibilities

What the control asks

Managers are to insist that everyone working for the organization applies information security as the organization's policy, topic-specific policies and procedures lay down. Purpose: make sure managers grasp their own part in information security and act so that all staff know and carry out their security duties. Guidance: management shows visible backing for the policies, procedures and controls. Its duties include making sure people are briefed on their security role before they receive access to information and assets; are given written expectations for their role; are required to follow the policies; reach a level of awareness that matches their role (see 6.3); keep to the security terms of their employment contract or agreement and the expected ways of working; maintain the right security skills and qualifications through continuing education; have, where practical, a confidential route for reporting breaches of policy or procedure (whistleblowing), which may be anonymous or restrict knowledge of the reporter's identity to those handling the report; and are given enough resources and planning time to implement the security processes and controls.

Purpose in the standard’s terms, in our words: Ensures managers understand their information security role and act so that all personnel know and meet their responsibilities.

Attribute values in one line: Preventive; Confidentiality, Integrity, Availability; Identify; Governance; Governance and ecosystem.

The five attribute values

These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.

Evidence an auditor asks for

The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.

• Evidence that security briefings on roles and responsibilities occur before access is granted, such as onboarding checklists tied to access provisioning
• Role-specific guidance documents setting out security expectations
• Signed employment contracts or agreements containing the security obligations
• Records of continuing professional education for staff in security-relevant roles
• A confidential or anonymous reporting channel for policy violations with its handling procedure
• Project plans or budgets showing resources and time allocated to security processes and controls

Where audits commonly find gaps

• Access is provisioned before any security briefing takes place
• No confidential route exists for reporting violations, or reporters' identities are not protected
• Managers do not visibly endorse the policies, so compliance is seen as the security team's concern
• Security work is expected without any allocated time or resource in project plans

What ISO/IEC 27028 changes for this control

It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. Its earlier numbering (07.2.1) is kept in the register so an older audit file can still be traced.

The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.

Controls that share its values

• 5.1 Policies for information security
• 5.2 Information security roles and responsibilities
• 5.8 Information security in project management

Read the five attributes All 93 controls