Security and Resilience in Organizations and their Supply Chains

ATTENTION: This page is intended to be viewed online and may not be printed or copied.

6. Leadership

6.1 General

Top management shall provide evidence of active leadership for the ORMS by overseeing its establishment and implementation, and motivating individuals to integrate security and resilience as a central part of the mission of the organization and its culture.

6.2 Management Commitment

Top management shall provide evidence of its mandate and commitment to the development and implementation of the ORMS to achieve intended outcomes and continually improving its effectiveness by:

• Identifying strategic, operational, tactical, and reputational objectives;

• Establishing the ORMS policy;

• Articulating a shared sense of joint purpose and values underlying decision-making processes;

• Instilling a sense of ownership in the ORMS to persons working on behalf of the organization and recognizing their contributions;

• Establishing risk criteria including risk appetite;

• Reviewing risk assessment and performance assessment outcomes;

• Communicating to the organization the importance of meeting ORMS objectives and conforming to the ORMS policy;

• Communicating to persons working on behalf of the organization the importance of adhering to legal obligations and voluntary commitments;

• Providing sufficient resources to establish, implement, operate, monitor, review, maintain, and improve the ORMS. Internal and external resources include but are not limited to people with specialized skills, equipment, infrastructure, technology, information, and financial resources;

• Encouraging and supporting management at all levels and other persons working on behalf of the organization to integrate a security, risk, and resilience culture and awareness into their areas of responsibilities;

• Aligning organizational incentives in a manner consistent with ORMS objectives;

• Conducting at planned intervals, management reviews of the ORMS; and

• Promoting the need for continual improvement.

6.3 Policy

Top management shall establish a ORMS policy. The policy shall:

• Provide a clarity of purpose and shared vision for the ORMS;

• Provide a framework for setting and reviewing ORMS objectives, targets, and programs;

• Be consistent with the organization’s other policies;

• Empower persons working on behalf of the organization to recognize their role in the ORMS and achievement of objectives;

• Provide a commitment to comply with applicable legal, regulatory, and contractual requirements as well as voluntary commitments;

• Include a commitment to human rights and public safety as a top priority;

• Provide a commitment to avoid, prevent, and reduce the likelihood and consequences of undesirable or disruptive events;

• Be documented, implemented, and maintained;

• Be communicated to all appropriate people working for or on behalf of the organization;

• Be available to stakeholders;

• Be visibly endorsed by top management;

• Include a commitment to continual improvement; and

• Be reviewed at planned intervals and when significant changes occur.

6.4 Organizational Roles, Responsibilities, and Authorities for the ORMS

Top management shall ensure that the responsibilities and authorities for relevant ORMS roles are designated and communicated within the organization.

The organization shall appoint one or more individuals within the organization who – irrespective of other responsibilities – shall have defined competencies, roles, responsibilities, and authority for:

• Ensuring that a ORMS is established, communicated, implemented, and maintained in accordance with the requirements of this Standard;

• Identifying and monitoring the needs and expectations of the organization's internal and external stakeholders, and take appropriate action to manage these needs and expectations;

• Ensuring that adequate resources are made available;

• Promoting awareness of ORMS requirements throughout the organization; and

• Reporting on the performance of the ORMS to top managers for review and as a basis for continuous improvement.

Top management shall ensure those responsible for the ORMS have the authority and competence to be accountable for the implementation and maintenance of the management system.

Next: Planning