5.2 Information security roles and responsibilities
Information security roles and responsibilities are to be set out and assigned to people in a way that fits what the organization needs. Purpose: create an agreed, approved structure, understood by everyone, for putting information security in place, running it and managing it. Guidance: assignments follow the information security policy and the topic-specific policies, and cover who protects information and associated assets, who carries out particular security processes, who performs risk management and especially who accepts residual risk (such as risk owners), and the duties of everyone who uses the organization's information and assets. Site-level or facility-level detail is added where needed. A person holding a security responsibility may hand tasks to someone else but stays accountable and should confirm the delegated work was done properly. Each area of responsibility is defined, written down and communicated, and authorization levels are documented. People in security roles need the knowledge and skills the role demands and should get support to stay current. Other information notes that many organizations name an information security manager with overall responsibility, that resourcing and implementation often stay with line managers, that asset owners commonly carry day-to-day protection, and that in smaller organizations security may be part of existing jobs rather than a dedicated post.
Source: ISO/IEC 27002:2022, 5.2. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27002:2022 in the compliance library.
ISO/IEC 27002 is guidance on the Annex A controls; certification is against ISO/IEC 27001. Use this set when your sheet follows the 27002 numbering.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Named risk owners with evidence that they accepted residual risks · Document repository
- Records showing delegated security tasks and the accountable person's confirmation that they were completed correctly · Document repository
governing documentDocuments that govern the control
- A documented roles and responsibilities matrix covering asset protection, specific security processes, risk management and residual risk acceptance, and user duties · Policy repository / GRC workspace
- Documented authorization levels for each security role · Policy repository / GRC workspace
- Competence requirements for security roles with training or certification records and ongoing development · HR system / LMS
- Site-specific or facility-specific responsibility supplements where the organization operates several locations · Policy repository / GRC workspace
First move
Common gaps auditors find
- Residual risk is accepted by the security team rather than by the business risk owner
- Responsibilities are defined in a policy but not communicated to the people who hold them
- Delegation happens without any check that the delegated task was performed
- People in security roles have no defined competence requirement or development plan
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet5.1 Policies for information security · 5.3 Segregation of duties