Terms and definitions
Four terms carry the whole model: the entity, the organization, the governing body and top management. The boundary between them is the point.
This clause sets the scope, the vocabulary or the structure. It is guidance, not a requirement, and it is the base every later clause builds on.
What clause 3 asks
Four words do the structural work. An entity is the wider body, which can be a group, a company or another party, and it holds authority over the organization. The organization is the slice of the entity that operates the management system. A governing body answers for how the entity performs and whether it conforms. Top management runs the organization at its highest level, can delegate and provide resources, and reports upward; where the system covers just one part of a wider body, top management means the people who run that part, and they answer to the entity board. The same people may hold both roles in a small company, and the text allows it.
Why it matters
The four terms are the difference between a governance model and an org chart. In a small company one person can hold every role, and the standard accepts that, but the accountability still has to be separated in practice. In a group, the entity is larger than the ISMS organization, so the governing body sits above the people who run the management system. A record that uses organization for both levels cannot say who accepted a risk or who set the direction. The definitions also explain why a governing body can govern several management systems at once, and why the top management of each one reports upward.
What good looks like
Build a one-page role map with four rows, one for each term, and put a name beside each. Add the date and the appointing body. For a small company, write down how the separation between setting policy and executing it is achieved even where one person holds both roles. Use the four terms consistently in policies, minutes and the risk register, and correct documents that use organization loosely.
Evidence a board or an auditor asks for
The role map with names, dates and appointing bodies; the board minutes that record the appointments; a note of how policy setting and policy execution are separated where one person holds both.
- Record The role map with names, dates and appointing bodies
- Record the board minutes that record the appointments
- Record a note of how policy setting and policy execution are separated where one person holds both
Where it commonly fails
- The same person treated as governing body and top management with no separation recorded
- A group policy that calls every level the organization
- Top management named without the governing body it reports to
What to do before publication
Before the edition 3 text is published, put clause 3 on the scope and foundations agenda, name the owner of each line above and give it a review date. When the final draft or the published text is available, compare it with this record and note every difference.
Read across
- 1 Scope
- 6.1 Overview: governance and management of information security
- 8.2.1 Type A: The entity and the ISMS organization are the same
- 8.2.2 Type B: The entity contains the ISMS organization