Which of the following activities are responsibilities of top management?

ISO/IEC 27001:2022 clause 5.1 lists top-management duties: ensuring ISMS objectives align with strategy, integrating ISMS into processes, allocating resources, communicating importance, and promoting continual improvement.

A: Day-to-day control operation is delegated and not included in clause 5.1.

B: Conducting internal audits is an organisational task (clause 9.2) that management only supports, not performs.

C: Maintaining an asset register is an operational control (Annex A 5.9), not a top-management responsibility.

1. ISO/IEC 27001:2022, Clause 5.1 a–f, p.6-7.

2. ISO/IEC 27001:2022, Clause 9.2, p.12.

3. ISO/IEC 27001:2022, Annex A 5.9, p.17.