In previous blogs, we have tackled a number of fundamental ISO 27001 components. In this blog, we’ll take a look at management commitment, one of the most significant.
Commitment from your leadership team is absolutely crucial to managing information security within your organisation. In just the same way as pretty much any initiative, if your organisation’s leadership doesn’t believe in information security and doesn’t demonstrate that it believes in it, then any initiatives and improvements are highly likely to fail.
The attitude of your leaders has a big impact upon the success or failure of your information security efforts, as their behaviour directly affects the culture of your organisation. Those organisations with members of the leadership team that visibly demonstrate a lack of support for the information security management system will find it very difficult to convince others within the organisation to behave differently. This can lead to a negative security culture within the organisation.
So, we know that gaining management commitment is vital, but exactly how do we demonstrate this?
There are several different ways in which your leadership team can demonstrate support and commitment to the cause. The first is with direct involvement in information security governance. Governance is primarily about effective communication. This starts from the leadership team down through development, approval and implementation of effective policy and continues from the rest of the business upwards, through effective reporting. Your leadership team should be directly involved in the decision-making process regarding appropriate policy to be implemented, and approve those policies once drafted. Similarly, leadership should demonstrate that it is taking any reporting seriously and should be involved in decisions made in response to such reports.
There are other areas which leadership should get involved with including:
- Communicating directly with the business regarding the importance of information security, e.g., through the use of newsletters, chat sessions, video broadcasts etc
- Signing off residual risk and agreeing on the risk appetite
- Supporting other management roles throughout the organisation to ensure that policy and processes are embedded
- Chairing risk and audit committee meetings and information security forum sessions
- Ensuring that appropriate and adequate resources are provided for the implementation, operation and continual improvement of your information security efforts.
Of course, there is a critical driver for the leadership team to get involved in order to ensure that your information security efforts are performing as expected – that driver is accountability. Depending upon their position within the organisation, members of the leadership team could be held personally liable if your information security efforts fail to such a degree that legislative or regulatory requirements are not met.
Having been involved in over 350 successful ISO 27001 certifications, URM is ideally placed to advise you on the essential activities and tasks you will need to carry out in order to maintain and improve your ISO 27001 auditing function and programme
URM can help you get ISO 27001 certification
URM can help you with ISO 27001 audit
This blog talks about information classification. So, what exactly do we mean by information classification?
In order to meet the requirements of ‘Asset management’ A.8 from Annex A of ISO 27001, it is necessary to identify organisational assets and define protection
With this blog, the spotlight turns to internal audit and specifically in the context of ISO 27001, the International Standard for ISM.