Objective 5: Foster a security-positive culture
Security depends on people, so objectives, roles, responsibilities and resources have to point in the same direction, and top management has to require and support that coordination.
What clause 7.2.5 asks
People decide whether security works, so the clause looks at the machinery around them. Objectives, roles, responsibilities and resources have to point the same way; when they pull apart, every other objective suffers. Leadership should require, promote and support coordination across interested parties, and that support underpins education, training and awareness. Security duties should be written into the roles of staff and other parties, who then carry them. This is a culture clause, but its test is concrete: does a role description name the duty, does the performance conversation reward it, and does a conflict between speed and security get resolved in the open? Posters do not answer those questions.
Why it matters
Culture is the objective that boards find easiest to approve and hardest to evidence. The clause is specific about the mechanism: it is not posters, it is the alignment of objectives, roles, responsibilities and resources. When a sales target rewards speed and a security control slows the deal down, the culture is decided by which one the performance review mentions. When a role description omits the security duty, the duty belongs to nobody. Top management visible support matters because it signals which conflict will be resolved in which direction. The objective also covers other parties, so contractors and suppliers are inside the culture, not outside it.
What good looks like
Audit ten role descriptions across the functions that touch information and check that the security responsibility is written in. Check the objectives and incentives for a conflict with security, and resolve the ones you find in writing. Ask top management to sponsor one specific coordination action each quarter, with a result. Measure the culture through behaviour the organization can see, such as reporting rates, near miss sharing, and whether people stop a change when the security check fails, rather than through attendance at training.
Evidence a board or an auditor asks for
Ten role descriptions with the security responsibility; the objectives and incentives review with conflicts resolved; the top management sponsorship record; the behaviour measures and their trend.
- Record Ten role descriptions with the security responsibility
- Record the objectives and incentives review with conflicts resolved
- Record the top management sponsorship record
- Record the behaviour measures and their trend
Where it commonly fails
- Security treated as the security team job by everyone else
- Conflicting objectives between a business unit and security left unresolved
- Awareness measured only by completion rates
What to do before publication
Before the edition 3 text is published, put clause 7.2.5 on the entity governance and the objectives agenda, name the owner of each line above and give it a review date. When the final draft or the published text is available, compare it with this record and note every difference.
Read across
- 6.4 Thread of governance within the organization
- 7.2.1 Objective 1: Establish integrated, comprehensive, entity-wide information security
- 7.2.6 Objective 6: Ensure the security performance meets current and future requirements of the entity
← 7.2.4 Objective 4: Ensure conformance with internal and external requirements7.2.6 Objective 6: Ensure the security performance meets current and future requirements of the entity →