## Clause 5: Leadership

Clause 5 has three subclauses: Leadership and commitment, Policy, and Organizational roles responsibilities, and authorities. 

The point of [Clause 5.1](../../../MoCs/ISO_27001_2022_5.1_MoC%20Leadership%20and%20commitment.md) is that there is support and commitment from an organization's senior leadership ('top management') to run and operate an ISMS in the long term. They should be overseeing and supporting the implementation of an ISMS.
Who top management are will depend on the type of organization we're dealing with and the scope of the ISMS. In general top management will have titles like director, C-level executives, etc.
But if the scope of the ISMS is limited to for instance a national subsidiary of an international firm, top management might be the Country Director. In a small company it might be the owner.

The involvement expected of top management is making sure that we not only have the necessary resources to implement the ISMS, but to run and operate it in the long term as well. These may be financial, technological and human resources.

Top management also has to make sure that people in the organization are aware that information security and implementing the ISMS is actually a top management concern, and not just the IT department's concern.
They should be proactively reviewing the management system, driving continual improvement.

We will see that again in Clause 9.3 with the Management review.

### Clause 5.2: Policy
[Clause 5.2: Policy](../../../MoCs/ISO_27001_2022_5.2_MoC%20Policy.md)

An important way for top management to show their commitment is by establishing an information security policy. A policy, according to ISO, is 'the formal intent and direction as expressed by an organisation's top management'.

The information security policy must match the purpose of the organization.

The policy should include, or reference, the security objectives, include a commitment to continual improvement, and a commitment of satisfying applicable requirements (legal, regulatory, and contractual).

This is usually a fairly short document, available to everyone in the organization, that sets the tone and direction with regards to information security, including tangible commitments, like appropriate training, risk treatment, effectiveness monitoring, etc.

Later on there will be other, more detailed topic specific policies, like cryptography, network security, and application security. This is treated in Annex A.

### Clause 5.3: Organizational roles, responsibilities and authorities
[Clause 5.3](../../../MoCs/ISO_27001_2022_5.3_MoC%20Organizational%20roles,%20responsibilities%20and%20authorities.md)

To argue that the top management is committed, and to have an effective ISMS, people need to be appointed to actually run and operate the ISMS, and be formally authorised to do so. That means assigning responsibilities for activities like risk assessments, policy creation, incident handling or conducting internal audits.

People need to report on the performance of the ISMS and conformity to the standard (ISO 27001) to top management, so they can't just allocate roles and be done with it.

The standard does not give instructions on specific job titles and responsibilities, as they will be different for every organization.
