Control 5.3Organizational roles, responsibilities and authorities
Top management must ensure that the responsibilities and authorities for roles relevant to information security are assigned and communicated — in particular the responsibility for ensuring the ISMS conforms to the standard, and for reporting on its performance to top management.
The two named responsibilities are deliberately separated from the general assignment. Somebody must own conformity, and somebody must report performance upward; the standard does not require them to be the same person or to hold a particular title.
The recurring weakness is assignment without authority. A role responsible for the ISMS but unable to require anything of the functions that operate the controls will report performance accurately and change nothing — which the management review in 9.3 will then record year after year. Assignment is also where the segregation expected by A.5.3 begins, and an organisation small enough that one person holds every relevant role should say so and compensate rather than leave the conflict undocumented.
How to put this in place
Someone must own each part of the ISMS, or tasks fall between teams. The project needs roles assigned and understood, including who reports performance to top management.
- List the roles the ISMS needs, such as sponsor, ISMS manager, risk owners, control owners and auditors.
- Assign named people, including a deputy where possible.
- Write the responsibilities into job descriptions or a role document.
- Get top management to approve the assignments.
- Confirm the people accept them and have time to do the work.
Evidence an auditor usually looks for: a roles and responsibilities document, approvals by top management, and people who can describe their role.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
ISO 27001 Implementation Methodology & Project PlanWord
Covered in Phase 1 (Decide and scope) of the implementation plan, which sets out the work and the gate that closes the phase.
Stage 1 and Stage 2 Audit Preparation GuideWord
Listed in the table of what an auditor is likely to ask for and sample, by clause, with the likely challenge.