ISO 27001 Control A.5.4: Management Responsibilities

You can write the best policies in the world and still watch them fail, because the people who set the tone for everyone else do not follow them. When a director shares a password to save time, or a team lead tells a new hire to ignore the security training “just this once”, the written rules lose to the real ones. A.5.4 exists to close that gap. It is the fourth of 37 organizational controls in Annex A.

The control is short, but it carries a lot of weight. It makes information security part of what it means to manage people, not a separate topic that belongs to the IT team or a security officer. Managers do not need to become security experts. They need to expect secure behavior from their teams, show it themselves, and make it easy.

What the control requires

Annex A control 5.4 of ISO 27001:2022 states that management shall require all personnel to apply information security in accordance with the established information security policy, topic-specific policies and procedures of the organization.

The key elements:

Management - everyone with responsibility for directing people, from top management to team leads and project managers
Shall require - an active expectation, communicated and followed up, not a passive hope
All personnel - employees, contractors and others working under the organization’s control, with no exemptions for senior staff
In accordance with the policy, topic-specific policies and procedures - the rules you have already established, such as those described in policies for information security

A.5.4 is a preventive control in ISO/IEC 27002:2022. It prevents the slow drift between what is written and what is done. Annex A states the control; ISO 27002 gives guidance, including that managers should make sure personnel are properly briefed on their roles before getting access, are given guidelines stating expectations, are motivated to fulfil the policies, and have appropriate awareness and skills. It also mentions providing a channel for reporting concerns anonymously, which we will return to below.

How to implement management responsibilities

Make the expectation explicit

Do not assume managers know what you want from them. Put the expectation in writing, in their role descriptions, in management onboarding and in the policy itself: each manager is accountable for their team applying the security rules. Top management expresses this through the leadership commitment described in clause 5.1, Leadership and commitment, and the middle layer turns it into daily practice.

Give managers a short, practical checklist rather than a policy binder. For example:

Before a new starter gets access, they have been briefed on their role and the rules that apply to it
Training and acknowledgement are completed on time, and you know who is overdue
Access and equipment are requested and removed through the proper process
Concerns, near misses and incidents are raised and treated as learning, not blame

A page of this kind is more useful than fifty pages of policy text.

Brief people before they have access

The control expects people to understand their security responsibilities before they are given access to information or systems. Build this into the joining process: the manager confirms that the new starter has read the relevant policies, knows who to ask, and has had the conversation about what is expected in their specific role. This links directly to terms and conditions of employment, which set out responsibilities contractually, and to information security awareness, education and training, which builds the knowledge behind them.

Contractors and temporary staff deserve the same treatment. They often have the broadest access and the least context, so the manager responsible for the engagement should own their briefing.

Lead by example and make security easy

People copy what they see. If managers lock their screens, use the approved password manager, report phishing emails and follow the clear desk habits, their teams will do the same. If managers bypass controls because they are busy, teams conclude that the controls are optional.

Equally important is removing friction. If the secure way to share a file takes six clicks and the insecure way takes one, you have designed a workaround into the process. Ask your managers which rules their teams struggle with and fix the rule or the tool. This is the practical meaning of a motivated workforce: people who want to follow the policy because it helps them do their job.

Build a culture where people speak up

ISO 27002 guidance points to a reporting channel for concerns, and that is a leadership matter. Staff report mistakes only when they trust that the response will be fair. Make it clear that reporting an accidental click on a phishing link is welcomed, and keep sanction for deliberate or repeated disregard of the rules, through the disciplinary process. Consider whether staff can raise concerns about management behavior itself without fear, perhaps via an anonymous route or a trusted person outside the line.

Follow up and measure

Management responsibility needs evidence. Track training completion by team, results of spot checks, outstanding policy acknowledgements and the number of security events reported. Review these in regular management meetings and, at a higher level, in the management review. The numbers do not need to be impressive; they need to show that someone is paying attention and acting on what they see.

A practical rhythm helps here. Many of the teams we work with add a five-minute security item to an existing weekly or monthly team meeting: one recent event, one reminder, one question from the team. It costs almost nothing, keeps the topic alive between annual trainings, and gives managers a natural place to show that they take the rules seriously. It also produces a light trail of evidence, such as meeting notes, that shows the control operating through the year and not only in the week before an audit.

A.5.1 connection. Policies for information security provides the rules management requires people to follow.

A.5.2 connection. Information security roles and responsibilities defines who is responsible for what, including the managers themselves.

A.5.3 connection. Segregation of duties is one of the practices managers must apply when allocating work.

A.6.2 connection. Terms and conditions of employment sets out personnel responsibilities in contractual form.

A.6.3 connection. Information security awareness, education and training gives people the knowledge that managers then expect them to apply.

Clause 5.1 connection. Leadership and commitment is the top-level obligation of which this control is the day-to-day expression.

Forward reference. Contact with authorities and special interest groups, covered in the next two controls, are examples of responsibilities that management often needs to assign clearly.

What auditors check

Manager awareness. Auditors interview team leads and ask what they are expected to do about security. Vague answers suggest the expectation was never communicated.

Role descriptions and onboarding. They look for security responsibilities in management role descriptions and for evidence that new starters were briefed before gaining access.

Training and acknowledgement records. Completion rates by team, and what happens when someone is overdue, show whether managers follow up.

Behavior at the top. Auditors observe whether senior people follow the same rules as everyone else, for example badge use, clear desk and device handling.

Reporting channels. They check that staff know how to report concerns and that reports are handled constructively.

Management review input. Evidence that security performance of teams is reviewed and acted on completes the picture.

Common mistakes to avoid

Delegating everything to the security officer. If managers believe security is someone else’s job, the control is not operating.

Exempting senior staff. The fastest way to destroy a security culture is a rule that applies to everyone except the people who wrote it.

Briefing after access is granted. Telling someone the rules three weeks after they started defeats the preventive purpose.

Treating every mistake as misconduct. If people fear punishment for honest errors, incidents stay hidden and you lose the chance to learn from them.

No follow-up. A policy acknowledgement that is requested and never checked is a record of intent, not evidence of control.

Ignoring contractors. Temporary staff and suppliers’ people often work with real data; their managers carry the same responsibility.

How 27kay can help

We help organizations turn management responsibility from a sentence in a policy into habits that managers can actually keep. As part of ISO 27001 implementation, we write short manager checklists, design joiner and leaver routines that fit your culture, and set up simple measures that show what is working. For the full picture, see our ISO 27001 knowledge hub.

If your newest team lead was asked tomorrow what security expects of them, what would they say? Get in touch - we will help you make sure the answer is a good one.