Which statement describes a critical success factor for an Information Security Management System ISMS?

The single most critical success factor for an ISMS is visible, active, and ongoing commitment from top management. ISO/IEC 27001:2022 heavily emphasizes this in Clause 5.1 "Leadership and commitment." Leadership support ensures the ISMS is aligned with strategic business objectives, receives adequate resources (funding, staffing, time), and that its importance is communicated throughout the organization. Without this executive sponsorship, an ISMS initiative is likely to be treated as a low-priority IT project and will fail to achieve its objectives or be sustained over time.

Implementing the most expensive security technology available: Technology is a tool, not a goal. An effective ISMS depends on a balance of people, processes, and technology.

Achieving certification in the shortest possible time: Rushing the process can lead to a superficial, non-functional ISMS that does not genuinely manage risk.

Documenting every single procedure regardless of its relevance: Over-documentation is inefficient and can make the ISMS unmanageable. Documentation should be appropriate and add value.

ISO/IEC 27001:2022, "Information security, cybersecurity and privacy protection — Information security management systems — Requirements," Clause 5.1 "Leadership and commitment".

von Solms, B., & von Solms, R. (2004). "The 10 deadly sins of information security management." Computers & Security, 23(5), 371-376. This paper identifies lack of management commitment as a primary reason for failure. DOI: https://doi.org/10.1016/j.cose.2004.05.002