Type A: The entity and the ISMS organization are the same
Where the entity and the system organization are one body, the board also leads the system, and the separation of policy setting from policy execution has to be created deliberately.
What clause 8.2.1 asks
In the simple case the wider body and the system organization are one and the same. One management system may supply the risk information the organization needs to govern information risk, while other processes still support technology, finance, operations and the rest. The four processes do not change. The people at the top carry governance duties beyond security, including corporate governance. Aligning security objectives with entity objectives is easy because the same leaders set both. The risk is that governance folds into management. Where one role holds both, the text asks for adequate advice and a real separation between answering for policy and carrying it out. The test is whether someone other than the author can reverse a decision.
Why it matters
Type A is the common case for a single company and for many public bodies. The advantage is speed of alignment: the people who set the business objectives also set the security objectives, so the two can be joined without translation. The risk is that governance collapses into management. The board approves a policy and then the same directors execute it, review it and report to themselves. The standard does not demand a second board. It asks for adequate advice and a separation of accountability, which can be met with an independent adviser, an audit committee, a non-executive director or a clear decision record that shows who challenged whom. The test is whether a decision could be reversed by someone other than the person who made it.
What good looks like
Write the Type A statement: the entity and the system organization are one body, the board also leads the system, and the following arrangements separate policy setting from execution. Name the adviser, the audit route or the non-executive challenge that provides the separation. Record a decision where the separation was used, not only where it was designed. Keep corporate governance duties and security governance duties on the same board calendar so one does not crowd out the other. Review the arrangement when the organization grows or the group structure changes.
Evidence a board or an auditor asks for
The Type A statement with the separation arrangement named; the adviser or audit route terms; a board minute where the separation changed a decision; the combined board calendar.
- Record The Type A statement with the separation arrangement named
- Record the adviser or audit route terms
- Record a board minute where the separation changed a decision
- Record the combined board calendar
Where it commonly fails
- The person who sets the security policy marking their own work with no separation
- A small board that treats governance as an annual policy approval
- An adviser appointed on paper who never sees a decision
What to do before publication
Before the edition 3 text is published, put clause 8.2.1 on the the governing body and the isms agenda, name the owner of each line above and give it a review date. When the final draft or the published text is available, compare it with this record and note every difference.
Read across
- 3 Terms and definitions
- 7.3.1 General
- 8.1 Organization and ISMS
- B Types of management system organization
← 8.1 Organization and ISMS8.2.2 Type B: The entity contains the ISMS organization →