Who should be involved, among others, in the draft, review, and validation of information security procedures?

The information security committee, or an equivalent governance body (e.g., ISMS Steering Committee), holds the primary responsibility for the oversight and strategic direction of the Information Security Management System (ISMS). This role inherently includes the review and validation of key documentation, such as procedures, to ensure they are aligned with the organization's security policies, objectives, and risk appetite. While operational staff may draft the procedures, this committee provides the formal approval and management commitment, which is a critical governance function for the successful implementation and operation of the ISMS.

A. An external expert is a supplementary resource used for specific advice, not a standing member responsible for the internal documentation lifecycle.
C. The employees in charge of ISMS operation are crucial for drafting procedures based on their technical expertise, but formal validation rests with a governance body.

1. Calder, A., & Watkins, S. (2019). IT Governance: An International Guide to Data Security and ISO 27001/ISO 27002 (7th ed.). Kogan Page Publishers. In Chapter 10, "Roles, Responsibilities and Competence," the text describes the function of an information security management forum or committee, which includes responsibility for reviewing and approving policies and supporting procedures.

2. PECB. (2021). ISO/IEC 27001 Lead Implementer Training Course Material. The training module covering ISO/IEC 27001 Clause 5, "Leadership," emphasizes the establishment of governance structures. It specifies that a steering committee is typically responsible for overseeing and approving key ISMS documentation to ensure top management commitment and direction.

3. Humphreys, E. (2016). Implementing the ISO/IEC 27001:2013 ISMS Standard. Artech House. Chapter 4, "Getting organized," details the roles within an ISMS implementation project, highlighting that a steering group or equivalent management body is responsible for the formal review and approval of documentation like policies and procedures.