The involvement of the organisation's top management is an essential part of the standard and critical for information security. Top management must establish and communicate clear roles and responsibilities for the ISMS to carry out the functions of information security to appropriate people. The standard requires the top management to assign the responsibility and authority to ensure all the requirements of the ISMS are met and to report the performance of ISMS. The successful implementation of clause 5 will provide accuracy, support and guidance from top management.
