Use and structure
The guidance describes how security governance works inside an ISO/IEC 27001 management system and how it connects to governance outside it, through four processes: evaluate, direct, monitor and communicate.
This clause sets the scope, the vocabulary or the structure. It is guidance, not a requirement, and it is the base every later clause builds on.
What clause 5 asks
Two settings are described. One is the management system built on ISO/IEC 27001; the other is the wider governance of the entity, which can reach beyond that system. The document sets out four processes, named evaluate, direct, monitor and communicate, and shows how a management system can be arranged around them. It then suggests how security governance can be joined to the entity's other governance through each process. An informative annex draws the link between organizational governance, technology governance and security governance. A management system covers the whole organization by definition, and that organization may be all of the entity or only a part of it, as the annex on relationship types illustrates.
Why it matters
Structure is the most useful thing in the document for a practitioner. The four processes give a board a repeatable cycle instead of a yearly presentation. Evaluate asks how well objectives are being met now and how well they are likely to be met. Direct sets direction, resources and risk appetite. Monitor checks performance and conformance. Communicate exchanges information with the people who need it. The cycle is not a project plan. It runs continuously, and each turn should leave a record. The clause also makes clear that the management system and the entity are different circles that can overlap, which is why a group can have several management systems under one governing body.
What good looks like
Draw the four processes as a cycle on one page and place the existing board and management meetings on it. For each process, name the meeting, the input, the decision and the record. Where a process has no meeting, that is the gap to fix first. Then map the ISMS and the entity on the Annex B figure so the reader can see which circle contains which. Use the same diagram in the board pack and the audit file so the two conversations refer to one model.
Evidence a board or an auditor asks for
The one-page process cycle with meetings, inputs, decisions and records; the entity and ISMS map; the board calendar showing where each process is exercised.
- Record The one-page process cycle with meetings, inputs, decisions and records
- Record the entity and ISMS map
- Record the board calendar showing where each process is exercised
Where it commonly fails
- A governance cycle that exists on a slide but has no meeting or minute behind it
- An ISMS described as covering the entity when its scope is narrower
- Communicate left out of the cycle because it is treated as public relations
What to do before publication
Before the edition 3 text is published, put clause 5 on the scope and foundations agenda, name the owner of each line above and give it a review date. When the final draft or the published text is available, compare it with this record and note every difference.
Read across
- 1 Scope
- 6.1 Overview: governance and management of information security
- 7.3.2 Evaluate
- 7.3.3 Direct
- 7.3.4 Monitor
- 7.3.5 Communicate
← 4 Abbreviations6.1 Overview: governance and management of information security →