Objective 1: Establish integrated, comprehensive, entity-wide information security
Security should be handled across the whole entity, with responsibilities and accountabilities that reach every activity, including information held by other parties.
What clause 7.2.1 asks
Coverage and coherence are the target, not uniformity. Security should be handled for the entity as a whole, decisions should reflect entity priorities, and physical and logical protection should work closely together. None of that requires one set of measures or one management system everywhere. Responsibility and accountability should reach every activity, including information that sits with suppliers or moves through other parties. A group can run several management systems and still meet the objective, provided the lines of accountability meet at the top. The phrase about external parties is the sharp edge: information held by a supplier remains the entity's information, and accountability does not move with the data.
Why it matters
Most security failures at board level are failures of coverage rather than of control. One business unit buys its own tools, another outsources a service, a third holds customer data in a supplier platform, and nobody at the top can say who answers for the whole. The objective asks the governing body to see the estate as one thing for accountability purposes while accepting that the delivery is plural. The phrase about external parties is the sharp edge. Information held or moved by a supplier is still information the entity owns, and the accountability does not transfer with the data. If the governance map stops at the payroll boundary, this objective is not met.
What good looks like
Build an accountability map across every activity that touches information, including the activities delivered by suppliers, cloud providers and partners. For each, name the accountable executive and the evidence that the accountability is live. Check the joins between physical and logical security, because a single incident often crosses both. Then test the map against the last three incidents or near misses. If an incident falls in a gap, the map is wrong, not the incident.
Evidence a board or an auditor asks for
The entity-wide accountability map with an accountable executive per activity; the supplier and external party schedule with the security owner; the physical and logical security coordination note; the incident review that tests the map.
- Record The entity-wide accountability map with an accountable executive per activity
- Record the supplier and external party schedule with the security owner
- Record the physical and logical security coordination note
- Record the incident review that tests the map
Where it commonly fails
- Security governed per business unit with no entity-level view
- Information held by a supplier outside anyone accountability
- Physical and logical security run by teams that never meet
What to do before publication
Before the edition 3 text is published, put clause 7.2.1 on the entity governance and the objectives agenda, name the owner of each line above and give it a review date. When the final draft or the published text is available, compare it with this record and note every difference.
Read across
- 3 Terms and definitions
- 6.1 Overview: governance and management of information security
- 6.4 Thread of governance within the organization
- 7.2.6 Objective 6: Ensure the security performance meets current and future requirements of the entity
- 8.1 Organization and ISMS
← 7.1 Overview7.2.2 Objective 2: Make decisions using a risk-based approach →