A.5.2
Information security roles and responsibilities
Organizational controlsCheckpoints 5Evidence 5Cases 5
Control objective
This control ensures that information security roles and responsibilities are clearly defined to suit the organization's needs and allocated to suitable people. When it is settled who is accountable for what, with no gaps or overlaps, policy implementation, asset protection, risk treatment, and incident response actually get done and accountability is unambiguous. It requires roles and authorities to be defined at each layer, from the chief officer (such as a CISO) through asset owners and operational staff to general personnel, and kept current as the organization and workforce change.
Key checkpoints
- Are information security roles and responsibilities (chief officer, security function, asset/system owners, operational staff, and so on) defined, documented, and allocated to suitable people?
- Are the necessary authority, resources, and reporting lines granted alongside each role so that it can actually be carried out?
- Are owners or responsible persons designated per asset, information system, and processing activity so that there is no gap in protection responsibility?
- Is there a procedure to update and reallocate roles and responsibilities when reorganization, joining/leaving/role change, or launch of new services occurs?
- Are the people aware of their allocated roles and responsibilities, and do they hold the competence needed to perform them?
Implementation guidance
- Document information security roles and responsibilities in a policy/regulation or a role description (such as a RACI matrix), stating each role's scope, authority, and reporting line.
- Assign accountable security leadership appropriate to organizational size and applicable obligations, with clear authority and reporting lines. Where a statutory CISO/CPO or similar office is required, verify its appointment and qualification requirements separately.
- Designate an owner/responsible person for each protected object (information asset, information system, personal data processing activity) to prevent gaps and overlaps in accountability.
- Define roles by position/job rather than by an individual's informal habit, so responsibilities are handed over when a person changes.
- Link the roles to HR processes so that role reallocation and revocation/transfer of privileges are triggered on transfer, departure, or role change.
- Define the competence (training, qualifications, experience) required for each role and ensure that assignees obtain and maintain it.
Evidence
- Policy/regulation or role description (such as a RACI matrix) defining information security roles and responsibilities
- Security leadership designation records (including CISO/CPO where applicable) and the organization chart
- List of owners/responsible persons per asset, system, and personal data processing activity
- Job descriptions or a specification of security responsibilities per role
- Records of role reallocation/privilege transfer following reorganization or personnel movement
Nonconformity examples
- A security organization chart exists, but the concrete responsibilities and authorities of each role are not defined, so the actual performer is unclear.
- The chief officer is designated only nominally, without real authority, resources, or reporting lines.
- Some information systems/assets have no designated owner or responsible person, creating a gap in protection responsibility.
- After a departure or role change, roles and responsibilities are not reallocated, so certain tasks are left unattended or privileges are not revoked.
- Roles and responsibilities rely only on an individual's informal practice and are not documented, so work stops when that person is absent.