Organizational roles, responsibilities and authorities

What the requirement asks

Top management must make sure that every role that matters for information security has its responsibilities and authorities assigned and made known internally, and must specifically assign responsibility and authority for making sure the ISMS conforms to this standard and for reporting ISMS performance to top management. A note allows responsibilities for internal performance reporting to be assigned as well.

What the guidance adds

Roles and authorities are expected to be assigned in a way that lets the system run. The guidance looks for the person who can approve a risk decision, the person who owns the ISMS, the person who reports performance and the route to top management. An organization chart without authorities is not an assignment.

What good looks like

Keep an organization chart or RACI for information security roles, approved by top management with the clause record, and give it an owner and a review date.

Evidence an assessor asks for

• Roles and responsibilitiesAn organization chart or RACI for information security roles, approved by top management
• Roles and responsibilitiesAppointment of the person accountable for ISMS conformity and for reporting performance to top management
• Roles and responsibilitiesJob descriptions containing information security responsibilities
• Roles and responsibilitiesPerformance reports delivered to top management by the assigned role

The question an assessor will ask

An assessor will ask for an organization chart or RACI for information security roles, approved by top management. The test for 5.3 is whether that record can be produced for a live sample, not whether the clause is described in a procedure.

Common gaps

• No one is formally assigned to report ISMS performance to top management
• Roles exist on paper but the holders are unaware of them
• Authorities are not stated, only responsibilities
• Role assignments are out of date after staff changes

Before the next audit

Before the next audit, test this against one live record: no one is formally assigned to report isms performance to top management.