Question:Who is responsible for ensuring that the ISMS achieves its intended outcomes?

According to ISO/IEC 27001:2022 Clause 5.1 – Leadership and Commitment:

“Top management shall demonstrate leadership and commitment with respect to the information security management system by:

e) ensuring that the ISMS achieves its intended outcomes.”

Top management must not only provide resources but also integrate ISMS into organizational processes, promote awareness, and support roles like the ISMS manager. While the ISMS project manager supports implementation, top management bears ultimate accountability.