How Do You Gain Top Management Commitment?

Latest update:
8 Aug

In previous blogs, we have tackled a number of fundamental ISO 27001 components.  In this blog, we’ll take a look at management commitment, one of the most significant.  

Commitment from your leadership team is absolutely crucial to managing information security within your organisation.  In just the same way as pretty much any initiative, if your organisation’s leadership doesn’t believe in information security and doesn’t demonstrate that it believes in it, then any initiatives and improvements are highly likely to fail.

The attitude of your leaders has a big impact upon the success or failure of your information security efforts, as their behaviour directly affects the culture of your organisation.  Those organisations with members of the leadership team that visibly demonstrate a lack of support for the information security management system will find it very difficult to convince others within the organisation to behave differently.  This can lead to a negative security culture within the organisation.

So, we know that gaining management commitment is vital, but exactly how do we demonstrate this?

There are several different ways in which your leadership team can demonstrate support and commitment to the cause.  The first is with direct involvement in information security governance.  Governance is primarily about effective communication.  This starts from the leadership team down through development, approval and implementation of effective policy and continues from the rest of the business upwards, through effective reporting.  Your leadership team should be directly involved in the decision-making process regarding appropriate policy to be implemented, and approve those policies once drafted.  Similarly, leadership should demonstrate that it is taking any reporting seriously and should be involved in decisions made in response to such reports.

There are other areas which leadership should get involved with including:

  • Communicating directly with the business regarding the importance of information security, e.g., through the use of newsletters, chat sessions, video broadcasts etc
  • Signing off residual risk and agreeing on the risk appetite
  • Supporting other management roles throughout the organisation to ensure that policy and processes are embedded
  • Chairing risk and audit committee meetings and information security forum sessions
  • Ensuring that appropriate and adequate resources are provided for the implementation, operation and continual improvement of your information security efforts.

Of course, there is a critical driver for the leadership team to get involved in order to ensure that your information security efforts are performing as expected – that driver is accountability.  Depending upon their position within the organisation, members of the leadership team could be held personally liable if your information security efforts fail to such a degree that legislative or regulatory requirements are not met.

Thumbnail of the Blog Illustration
Information Security
Risk Management – What is it and What Role Does it Play in ISO 27001?

We are going to explore why the focus on a risk-based approach has helped turn ISO 27001, the International Information Security Management Standard, into such a world-beater.

Read more
Thumbnail of the Blog Illustration
Information Security
ISO/IEC 27001:2022 Key Changes

Following the publication of ISO/IEC 27001:2022 on 25 October 2022, this blog will provide you with our high-level analysis of the key changes.

Read more
Thumbnail of the Blog Illustration
Information Security
10 Top Tips for Keeping Information Secure When Homeworking

Following on from COVID, working from home is now a standard working practice, but how do we go about it in a secure way. In this blog, we aim to provide 10 top tips to enable you to keep important

Read more
Great presentation, thanks. I enjoyed the interaction between lead speaker and support person.
Webinar 'Planning Your ISO 27001 Audit Programme'
contact US

Let us help you

Let us help you in your compliance journey by completing the form and letting us know how we can best support you.