Key takeaways
- Managers must make sure their people actually follow security policies.
- Policies only work if managers expect their teams to follow them.
- Start here: brief managers on the policies that apply to their teams.
Purpose
Managers must make sure their people actually follow security policies.
Requirement
Requirement summaryManagement shall require all personnel to apply information security in accordance with the established information security policy, topic-specific policies and procedures of the organization.
Why it matters
Policies only work if managers expect their teams to follow them. Management sets the tone and enforces the rules day to day.
How to implement
- Brief managers on the policies that apply to their teams.
- Make policy compliance part of onboarding and performance conversations.
- Ask managers to confirm their staff have completed required training and acknowledgements.
- Give managers a simple route to escalate non-compliance.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 5.4. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your information security policy with a clear statement that management expects everyone to follow it.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.5.4 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Management messages or meeting notes reminding staff about security.
- Training completion records showing managers make sure their teams finish required training.
- Staff objectives or reviews that include security expectations, where you use them.
Things you should be able to show or explain
- Managers should be able to explain how they encourage and check good security habits in their team.
How much to show: Speak to two or three managers from different teams.
Common mistakes
- Managers don't know they have security responsibilities.
- No way of holding people to the rules.
- Leaders who exempt themselves from the rules.
- Treating security as purely an IT responsibility.
- Tip: Add security to team meetings and performance check-ins.
Policies & documents to have
- Human Resource Security Policy
- Information Security Policy
- Information Security Roles and Responsibilities Policy
FAQ
Is A.5.4 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.5.4?
Be ready to explain how the control works in your organisation and to provide things like: Your information security policy with a clear statement that management expects everyone to follow it…