How Do You Gain Top Management Commitment?

|
|
PUBLISHED on
20 Jul
2022

Table of Contents

In previous blogs, we have tackled a number of fundamental ISO 27001 components.  In this blog, we’ll take a look at management commitment, one of the most significant.  

Commitment from your leadership team is absolutely crucial to managing information security within your organisation.  In just the same way as pretty much any initiative, if your organisation’s leadership doesn’t believe in information security and doesn’t demonstrate that it believes in it, then any initiatives and improvements are highly likely to fail.

The attitude of your leaders has a big impact upon the success or failure of your information security efforts, as their behaviour directly affects the culture of your organisation.  Those organisations with members of the leadership team that visibly demonstrate a lack of support for the information security management system will find it very difficult to convince others within the organisation to behave differently.  This can lead to a negative security culture within the organisation.

So, we know that gaining management commitment is vital, but exactly how do we demonstrate this?

There are several different ways in which your leadership team can demonstrate support and commitment to the cause.  The first is with direct involvement in information security governance.  Governance is primarily about effective communication.  This starts from the leadership team down through development, approval and implementation of effective policy and continues from the rest of the business upwards, through effective reporting.  Your leadership team should be directly involved in the decision-making process regarding appropriate policy to be implemented, and approve those policies once drafted.  Similarly, leadership should demonstrate that it is taking any reporting seriously and should be involved in decisions made in response to such reports.

There are other areas which leadership should get involved with including:

  • Communicating directly with the business regarding the importance of information security, e.g., through the use of newsletters, chat sessions, video broadcasts etc
  • Signing off residual risk and agreeing on the risk appetite
  • Supporting other management roles throughout the organisation to ensure that policy and processes are embedded
  • Chairing risk and audit committee meetings and information security forum sessions
  • Ensuring that appropriate and adequate resources are provided for the implementation, operation and continual improvement of your information security efforts.

Of course, there is a critical driver for the leadership team to get involved in order to ensure that your information security efforts are performing as expected – that driver is accountability.  Depending upon their position within the organisation, members of the leadership team could be held personally liable if your information security efforts fail to such a degree that legislative or regulatory requirements are not met.

Do you need any help with ISO 27001 certificate?

URM can help you achieve ISO 27001 certification
Thumbnail of the Blog Illustration
Information Security
Published on
22/7/2022
What are the Most Common Insider Threats to Information Security?

Broadly speaking, information security is held up by three pillars – People, Process and Technology. It is widely accepted that humans are the weakest link

Read more
Thumbnail of the Blog Illustration
Information Security
Published on
20/7/2022
Information Security Management Systems, ISO 27001 and the Benefits of Implementation

In this blog, we’re going back to basics and looking at some of the fundamentals of information security and ISO 27001.

Read more
Thumbnail of the Blog Illustration
Information Security
Published on
22/5/2023
Top Tips For Implementing an Effective ISO 27001 Information Security Management System (ISMS)

URM provides some top tips for achieving an effective and successful information security management system implementation

Read more
Without URM, Havas People would not of achieved its certification goals.
Director, Havas People
contact US

Let us help you

Let us help you in your compliance journey by completing the form and letting us know how we can best support you.