# Clause 5.1: Leadership and commitment

Top management must personally own the BCMS: aligning the continuity policy and objectives with the strategic direction, integrating BCMS requirements into business processes, making resources available, communicating why effective continuity and conformity matter, holding the BCMS to its intended outcomes, directing and supporting the people who deliver it, promoting continual improvement, and backing other managers to lead continuity in their own areas.

Cloud: Accountability for continuity does not move to the provider when the workload does. Leadership has to own the decision to accept a provider's resilience claims, fund the fallback, and sign the risk that remains.

Evidence: Minutes showing top management setting or approving continuity policy and objectives; Evidence of BCMS requirements embedded in business process documentation; Approved budget or resource allocation traceable to the BCMS; Internal communications from top management about continuity; Evidence of managers below top level held accountable for continuity in their areas.

Test: Name the executive who signs the residual risk for each critical cloud dependency.

Citation: ISO 22301:2019, clause 5.1. Source: https://compliance.theartofservice.com/frameworks/iso-22301-2019. Last updated: 2026-10-20.