Top management shows leadership of, and commitment to, the ISMS. Explanation: both are essential to an effective ISMS. Top management means whoever, one person or several, is in charge of the ISMS organization at its highest level, and it therefore holds overall responsibility for it, directing it as it directs other areas such as budgets; it can delegate authority and provide resources but keeps overall responsibility (where the ISMS belongs to a business unit, the unit's own leadership is top management). It also takes part in management review (9.3) and promotes continual improvement (10.2). Guidance: top management should see that the policy and objectives exist and fit the organization's strategic direction; see that ISMS requirements and controls are built into the organization's processes in a way that suits its context, for instance by delegating to process owners, and help overcome resistance to changed processes; make resources available for setting up, running, maintaining and improving the ISMS and its controls, namely money, people, facilities and technical infrastructure, sized to the organization's context, with management review indicating whether they suffice; explain why information security management and conformity with the ISMS matter, using practical examples from the organization's own situation; make sure the ISMS delivers its intended outcomes by backing all its processes and by asking for and reading reports on its status and effectiveness drawn from measurements, reviews and audits, possibly setting performance objectives for key personnel; direct and support those directly involved, with feedback on alignment with strategic needs and on priorities; weigh resource needs in management reviews and set objectives for improvement and for monitoring effectiveness; and back the holders of security roles so they are motivated and able to lead security in their areas. Where the ISMS sits inside a larger organization, engaging the leadership of the larger body helps: if it understands the ISMS and is involved in decisions on objectives and risk criteria and informed of outcomes, its resource decisions can match the ISMS's needs.
This control maps to 17 controls across 15 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 17 it maps to, and the evidence behind each claim, over MCP and REST.