ISO 27001 A.5.4: Make Security Part of Everyday Management

What A.5.4 requires in practice

Annex A control A.5.4 places an obligation on management: they must make sure everyone working for the organisation applies information security as set out in the established policy, topic policies and procedures. The weight falls on the word require. It is not enough to publish rules and hope; managers are expected to make secure working an ordinary condition of the job.

In practice the control has three strands. Managers make expectations clear to their teams. They set an example and treat compliance as part of normal performance. They respond when rules are ignored or when staff cannot follow them. The control covers all personnel, which includes people working under contract, not only employees.

The control does not specify tools, scorecards or disciplinary schedules. Those are choices that fit the organisation. What matters is that line managers, not just the security team, visibly own the application of security rules in their areas.

Explain what a role must do before relying on it

People need to understand the security responsibilities associated with the work they are about to perform. Managers can translate general policies into the decisions their teams encounter: handling a customer request, sharing a project file or using a privileged service function. A generic induction rarely resolves all those questions.

Check whether the individual has the competence and access needed for the assigned duty. A supervisor should not assume that course attendance authorises a specialist task. Where capability is incomplete, arrange development, supervision or a different allocation. Connect this with security education and training so that learning follows role requirements.

Remove incentives that reward bypassing controls

Compare security expectations with delivery measures. If employees are judged only on call duration or tickets closed, they may feel pressure to skip verification or stop investigating uncertain requests. Managers should make clear how authorised escalation affects performance assessment and provide a usable route when requirements conflict.

Resources matter as well as messages. Leave time for required checks, maintain accessible instructions and ensure that approved tools can support legitimate work. A team repeatedly requesting exceptions may be signalling a service-design problem. Management needs to investigate that pattern rather than label every difficulty a personal failure.

Respond consistently when concerns are raised

People are more likely to report an uncertain event if they expect a fair, useful response. Establish a route appropriate to the issue, including a way to raise concerns about instructions received from a manager. Confidential handling can be helpful where practicable, but do not promise absolute anonymity if the arrangement cannot deliver it.

Supervision should distinguish an accurate report, a capability gap and a deliberate policy violation. Investigate before drawing conclusions and use the organisation’s established processes. Disciplinary arrangements and event reporting serve different purposes; confusing them can discourage the early information needed to limit an incident.

Why management responsibility matters to the business

Staff take their cue from their managers. If a team lead brushes off a rule or asks for a shortcut, the policy loses force, however well it was written. When managers consistently expect and support secure behaviour, incidents fall, rules are applied with fewer exceptions and issues are raised earlier.

This control is also where leadership commitment becomes believable to outsiders. Assessors and customers can tell quickly whether security is something managers talk about or something they actually run. A business where responsibility sits only with a security officer tends to find that daily practice drifts away from the intended policy.

How to implement A.5.4

Make security part of how managers already lead people, rather than adding a parallel structure. Managers are busy, so keep their part light, specific and connected to work they already supervise.

1. Brief managers on which policies and procedures their teams must apply, in language tied to their work.
2. Include security expectations in onboarding, team meetings and routine performance conversations.
3. Give managers simple ways to check compliance in their area, such as short sampling of access reviews or clear-desk habits.
4. Agree what managers do when they find a breach or a rule that cannot be followed: correct it, report it and tell the policy owner.
5. Ensure contractors and temporary staff are covered by the same expectations through their line contact.
6. Report themes to senior management so repeated issues lead to changes in policy or resources.
7. Recognise good practice visibly, so security is seen as part of doing the job well.
8. Give managers a route to ask the security owner when a rule seems impractical, so problems become feedback instead of quiet workarounds.

Evidence an auditor expects for A.5.4

Common nonconformities with A.5.4

Weaknesses usually show a gap between the policy and what line managers do. Assessors usually test this control by talking to managers and their teams rather than reading policies.

• Managers interviewed cannot explain what their teams are required to do under the policy.
• Staff report that managers ask them to bypass rules to meet deadlines.
• Contractors are given access but are not told which rules apply to them.
• Breaches are found but not followed through, so the same behaviour repeats.
• Security responsibilities are absent from manager role descriptions or objectives, so nobody is expected to own them.

Illustrative BPO example: an urgent account change

Illustrative construction example: temporary project staff

A hypothetical contractor brings temporary staff into a project office to prepare a tender. The project manager assumes that access to the shared drive is enough preparation. The staff have not been told which commercial information can be shared with subcontractors or where draft documents should be stored.

The manager introduces a role briefing, confirms the correct access and assigns a knowledgeable contact for uncertain requests. A subsequent sample follows one shared document to its recipient and checks the decision. The practical evidence is that staff apply the expected handling rules, not merely that a briefing invitation was sent.

Assess management behaviour through real decisions

A.5.4 does not prescribe a particular meeting form or supervisor checklist. Evidence may include briefings, development decisions, resource changes, responses to reported concerns and the handling of exceptions. Interview staff as well as managers: can both explain what happens when a deadline conflicts with a security requirement?

Look for inconsistent expectations between shifts or sites. Common weaknesses include public support for security followed by private instructions to bypass it, managers exempting themselves from rules and repeated mistakes attributed to staff when instructions are contradictory. Use findings to improve supervision and work design, with appropriate accountability for decisions.