ISO 27001 A.5.4 - Management Responsibilities

Requirement

Management must require all personnel to apply information security in accordance with the organization’s information security policy, topic-specific policies, and procedures.

Plain-language meaning

Managers must actively ensure that people follow information security requirements.

This is not just about senior leadership approving a policy. It is about managers making security part of daily operations.

Core idea

A.5.4 makes information security a management responsibility, not only a security team responsibility.

Managers are expected to:

• communicate security expectations;
• ensure personnel follow policies and procedures;
• lead by example;
• support security controls;
• correct non-compliance;
• ensure training happens;
• reinforce security as part of normal work;
• motivate personnel to support security;
• monitor whether their teams comply.

The security team can create policies, advise, monitor, and report, but managers must ensure people in their area follow the requirements.

Difference between A.5.2 and A.5.4

A.5.2 is about assignment.
A.5.4 is about management enforcement and leadership.

Implementation guidance

1. Communicate expectations

Managers should make sure employees, contractors, and third-party users understand that information security is part of their job.

Examples:

• discuss security during onboarding;
• include security in team meetings;
• remind staff about incident reporting;
• reinforce acceptable use and data handling;
• ensure role-specific procedures are followed.

2. Lead by example

If senior people ignore rules, the control is weak.

Poor leadership examples:

• executives bypass MFA;
• managers do not lock screens;
• senior staff use personal email for company data;
• leadership ignores phishing training;
• managers approve exceptions without risk review;
• privileged users share admin accounts.

A.5.4 expects managers to model the same behavior they require from others.

3. Verify compliance during daily work

Managers should not wait for an annual audit to discover non-compliance.

4. Support security culture

Managers shape the real security culture.

People ignore security when they believe:

• speed matters more than control;
• management does not care;
• exceptions are normal;
• security is only a compliance exercise;
• reporting issues will get them blamed.

Managers should make security recognized, valued, and part of normal performance.

5. Correct non-compliance

If people do not follow controls, managers should respond.

Possible responses:

• coaching;
• remedial training;
• procedure clarification;
• access restriction;
• disciplinary action;
• formal corrective action;
• updating unclear procedures;
• reporting repeated non-compliance to HR/security.

The response should be proportionate. A one-time mistake may need training; deliberate bypassing may require formal action.

6. Encourage improvement

Managers can strengthen security by encouraging personnel to report:

• weaknesses;
• near misses;
• suspicious activity;
• improvement ideas;
• unclear procedures;
• inefficient controls.

Recognition programs can help, but even basic positive reinforcement matters.

Evidence for A.5.4

Audit guidance

Auditors should test whether management support is real, not just written.

The first check is whether managers know their responsibilities. The next check is whether they actually act on them.

Audit tests

Strong evidence

• Managers discuss security in recurring meetings.
• Managers track and follow up on training completion.
• Phishing simulation results lead to targeted coaching.
• Access reviews are signed by managers or system owners.
• Non-compliance results in remedial training or corrective action.
• Security expectations are included in performance objectives.
• Employees say management takes security seriously.
• Senior staff follow the same security rules as other personnel.
• Managers encourage reporting of security weaknesses and incidents.

Weak evidence

• Management approved policies but never mentions them.
• Managers ignore violations.
• Executives have informal exceptions.
• Training completion is poor and managers do not follow up.
• Employees say security is “just an IT thing.”
• Security is only discussed after incidents.
• Managers pressure staff to bypass controls for speed.
• No records show managers enforce procedures.

Common failures

Exam traps

• Management responsibility means only top management — wrong.
• Security team enforces everything — wrong.
• Approving a policy proves management responsibility — not enough.
• Security awareness alone is enough — not enough.
• Senior people can have informal exceptions — wrong; exceptions should be approved, risk-assessed, documented, and reviewed.

KB-ready summary

A.5.4 requires managers to actively require personnel to follow information security policies, topic-specific policies, and procedures. Managers must communicate expectations, lead by example, verify compliance, support training, address non-compliance, and make security part of daily operations.

Templates and checklists

• Management Security Responsibilities Checklist
• Manager Security Accountability Statement
• A.5.4 Audit Checklist
• Management Responsibilities Interview Questions