“Top management shall demonstrate leadership and commitment with respect to the information security management system by: ensuring the information security policy and the information security objectives are established and are compatible with the strategic direction of the organization.”ISO/IEC · ISO/IEC 27001:2022 — Information security, cybersecurity and privacy protection — Information security management systems — Requirements · 2022 · ISO/IEC 27001:2022, clauza 5.1 «Leadership and commitment», paragraful introductiv și litera a)
Clause 5 is audited in the executive office, not in the server room.
Clause 5 has three subclauses and every one of them starts with "top management", not with "the organization". The wording is deliberate: at 5.1 the auditor asks for evidence that the people who decide budget and direction did something checkable — made sure the policy and the objectives exist and fit the strategic direction, integrated the requirements into the organization's ordinary processes, made resources available, promoted continual improvement. At 5.2 the policy has to suit the purpose of the organization, contain objectives or the framework for setting them, and carry two commitments: to satisfy applicable requirements and to improve continually. It exists as documented information, is communicated internally and is made available to interested parties as appropriate. At 5.3 roles are assigned and communicated, and two responsibilities are named outright: that the system conforms to the standard and that its performance is reported to top management. This is why stage 2 interviews are not held with the technical team alone.
Why it matters A clause 5 nonconformity cannot be fixed with a tool: it needs a management decision, so it is the slowest kind to close.