Back to all 93 controls
Annex A 5.4
Organizational
A.5.4 Management responsibilities
Management actively requires staff to apply security.
What good looks like
Leadership communicates expectations, enforces policies, and holds people accountable.
Evidence an auditor will ask for
Management briefings, performance objectives, disciplinary records.
Put this control into practice
Check whether your organisation already meets Annex A 5.4 with the free Gap Analysis tool, or get implementation-ready templates for every Annex A control with the Document Pack.