5.2 Information security roles and responsibilities
Requires information security roles and responsibilities to be defined and allocated in line with what the organisation actually needs, so ownership of each security duty is explicit rather than assumed.
5
artefacts
1
held by a system
2
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Records showing asset owners, risk owners and control owners are identified and current · Policy repository / GRC workspace
periodic reviewEvidence produced at each review
- Evidence the allocation was formally approved and communicated to the holders · Policy repository / GRC workspace
- Evidence of reallocation when a role holder leaves or changes position · Identity provider / directory
governing documentDocuments that govern the control
- The documented allocation of information security roles and responsibilities, naming individuals or positions rather than teams · Policy repository / GRC workspace
- Role descriptions or terms of reference setting out the security duties attached to each role · Policy repository / GRC workspace
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your Policy repository / GRC workspace on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Security responsibility assigned to a function such as IT with no named accountable individual
- Role definitions written once at certification and never updated after reorganisation, leaving duties assigned to positions that no longer exist
- Holders unaware of the security duties recorded against their role
- Deputies and coverage for absence undefined, so the duty lapses when the holder is unavailable
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet5.1 Policies for information security · 5.3 Segregation of duties