Information security roles and responsibilities

Plain-language summary

Deciding who is responsible for what in information security — top management, the security lead, asset owners, risk owners and every user — and giving those roles to specific people on purpose, so nothing important belongs to nobody.

What the clause is really asking

Most security failures trace back to a task everyone assumed someone else was doing. This control asks you to decide which security roles your organisation needs, spell out what each involves, and give them to specific people: who runs the ISMS day to day, who owns each important information asset and its risks, who approves access, who handles incidents, and what every employee and contractor is answerable for. Name who does recurring tasks such as backup, patching and access reviews, and give role holders the competence and authority to act. Handing a task to someone else does not hand over accountability. The common misunderstanding is a single line saying 'the IT manager is responsible for security'; auditors expect owners outside IT too. Clause 5.3 covers the ISMS roles; this control covers the operational ones beneath them. In South Africa, align it with the Information Officer and any Deputy Information Officers (POPIA sections 55 and 56) registered with the Information Regulator, so the two structures agree. ISO 9001 users can extend their existing organogram and responsibility matrix.

What auditors look for

Auditors ask for whatever allocates security roles — a RACI, a responsibility matrix, job descriptions — and then test it against reality. They pick an asset from the inventory and ask its named owner what they do as owner: do they approve access, know the classification, review the risks? They interview the ISMS lead about their authority and the time they have for the role. They check that people who have left are no longer named in role documents. They compare the Information Officer registration with the ISMS role structure. The hard question: show me a security decision this owner made in the last year.

Typical evidence

Roles and responsibilities matrix (RACI) covering ISMS, asset, risk, process and incident roles; job descriptions or appointment letters stating security duties; asset and risk registers with named owners; Information Officer and Deputy Information Officer appointment letters and registration confirmation; competence records for role holders; organogram; handover records when role holders change.

How to comply — recommendations

Build a one-page RACI that lists the security activities that matter — policy approval, risk acceptance, access approval, access reviews, backup, patching, incident handling, supplier assessment, awareness — against named roles, not just IT. Assign an owner to every asset group in the inventory and every risk in the register. Add a security paragraph to job descriptions for key roles and a general clause to every employment and contractor agreement. Issue appointment letters to the ISMS lead, the Information Officer and deputies, and confirm the Information Officer's registration with the Information Regulator. Review the matrix at management review and whenever someone in a named role leaves.

Common nonconformities

All security responsibilities assigned to IT; asset or risk owners named in registers but unaware of their role; people who have left still listed as role holders; ISMS lead with no defined authority or time; Information Officer not registered or disconnected from the ISMS; no security responsibilities in job descriptions or contracts; conflicting role descriptions across documents.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.