Organizational roles, responsibilities and authorities

Plain-language summary

Making sure the jobs that keep the ISMS working are assigned to named people with the authority to do them, and that everyone knows who holds them — including the two the standard singles out: making the ISMS conform, and reporting on its performance to top management.

What the clause is really asking

An ISMS has owners or it has gaps. The clause requires top management to assign and communicate responsibilities and authorities for information-security-relevant roles, and names two that must exist: someone responsible for ensuring the ISMS conforms to the standard, and someone responsible for reporting on ISMS performance to top management. And the assignments must be communicated within the organisation, not just recorded. Beyond those two, the roles that typically need naming are risk owners (6.1.2 requires them), asset owners (Annex A 5.9), the incident response lead, the person who approves access, and — in South Africa — the POPIA Information Officer and deputies, who must be registered with the Information Regulator. Responsibility without authority is the classic failure: an ISMS manager who cannot require a system owner to patch is not in control of the ISMS.

What auditors look for

Auditors ask for the role definitions and then interview the people in them: do you know you own this risk, this asset, this process, and what are you expected to do? They test authority by asking what happens when a business unit refuses a security requirement — who can escalate, who decides. They check that the two mandatory roles are filled and that the performance-reporting role actually reports (management-review minutes, dashboards). They look at the Information Officer registration and at whether role assignments survived staff turnover: a RACI naming people who left two years ago is a finding.

Typical evidence

Organisation chart or RACI for ISMS roles; job descriptions or appointment letters for the ISMS lead, risk owners, asset owners, incident lead, Information Officer (and the Regulator registration); communication of roles (intranet page, induction, team briefings); management-review records showing performance reporting by the named role; access-approval and risk-acceptance records signed by the right people.

How to comply — recommendations

Draft a one-page RACI for the ISMS: each process and control family, who is Responsible, who Approves, who is Consulted and Informed. Fill it with job titles and the current names, publish it, and date it. Write short appointment letters for the ISMS lead and the Information Officer stating their authority (to stop a change, to require a fix, to report to the board). Name a risk owner for every risk and an asset owner for every asset group — owners are people who can make decisions about the thing, not administrators. Review the RACI at management review and whenever someone leaves.

Common nonconformities

The two mandatory roles not assigned or not distinguishable; risk owners and asset owners not named; roles assigned on paper to people who have left; responsibilities communicated to no one but the ISMS lead; ISMS lead with responsibility but no authority over system owners; POPIA Information Officer not appointed or not registered; no evidence of performance reporting to top management.

Resources for this clause

• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.