Type B: The entity contains the ISMS organization
Where the entity is larger than the management system organization, the same governing body can govern several systems, and each system has to be clear about whose objectives it serves.
What clause 8.2.2 asks
Governance normally covers a whole legal entity, so it reaches past any one management system. An entity may hold several systems under one board, and the four processes still apply. Three situations can arise. A system with its own business objectives aligns its security objectives to those. A system responsible for one or more parent objectives aligns to the parent. A system holding part of the parent's security risk on the parent's behalf has its objectives set by the parent. The people who lead each system and the people on the board may be the same, may overlap, or may be entirely different. The annex figure settles who counts as a board member and who counts as an interested party. A system that cannot name its situation cannot explain its performance.
Why it matters
Type B is where governance records most often lose the thread. There are several management systems, several top management teams and one board, and the lines between them are drawn in an org chart rather than in a decision record. The clause gives three situations that are easy to test. Does the system have its own business objectives? Then it aligns to them. Is it responsible for a parent objective? Then it aligns to the parent. Is it holding a risk on the parent behalf? Then the parent specifies the objectives. A system that cannot say which situation it is in cannot say what its performance means. The membership question matters too, because an interested party and a governing body member have different rights and duties in the cycle.
What good looks like
For each management system, write the situation it is in and the objectives its security objectives align to. Draw the membership map: who sits on the group board, who sits on each system top management, and where the two overlap. Check that the overlap is deliberate rather than inherited. Give each system a reporting line and a set of priorities from the governing body. When a new system is created or a business is sold, update the map and the objectives in the same decision.
Evidence a board or an auditor asks for
The situation statement for each management system; the membership map; the objectives alignment for each system; the governing body priorities communicated to each; the change record for the last structural change.
- Record The situation statement for each management system
- Record the membership map
- Record the objectives alignment for each system
- Record the governing body priorities communicated to each
- Record the change record for the last structural change
Where it commonly fails
- Several management systems in one entity with no defined alignment to the parent objectives
- Unclear who on the governing body speaks for which system
- A system holding a parent risk with objectives set locally
What to do before publication
Before the edition 3 text is published, put clause 8.2.2 on the the governing body and the isms agenda, name the owner of each line above and give it a review date. When the final draft or the published text is available, compare it with this record and note every difference.
Read across
- 3 Terms and definitions
- 7.3.1 General
- 8.1 Organization and ISMS
- 8.2.1 Type A: The entity and the ISMS organization are the same
- 8.2.3 Type C: One ISMS is shared by multiple entities
- B Types of management system organization
← 8.2.1 Type A: The entity and the ISMS organization are the same8.2.3 Type C: One ISMS is shared by multiple entities →