3. ISMS implementation and operation" phase

The organization must describe and implement a risk management policy that identifies the actions to be taken, and the dedicated personnel and resources. Responsibilities must also be defined, as well as risk priorities (unacceptable risks to be dealt with first).

• Responsibilities: Leadership (clause 5)

  Already existing Chapter 5 modified "management responsibilities" / "leadership". Change of vocabulary register for management responsibilities to ensure, lead and support, promote and communicate, rather than establish, decide, determine, provide and evaluate. A manager is needed to ensure ISMS compliance and effectiveness.

• Policy (clause 5.2)

  The Information Security Policy is generally a short, high-level document describing the...