ISO 27001 · clause 5.3

What gets handed down, and what stays at the top

Top management

Sets the direction, releases the budget, stays responsible for all of it.

Cannot be delegated
Delegates
the work
The assigned role
Keeps the management system in line with the standard
Reports how it is performing, upward
Needs real authority
Assigns
the doing
Team leads

Run the security steps in their own area: hiring, access, suppliers, releases.

Own their area