Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Control A.5.2Information security roles and responsibilities

What it means in practice

Information security roles and responsibilities must be defined and allocated according to the organisation’s needs.

This is the control that makes every other control ownable. A control with no named owner is not implemented — it is described. Allocation covers the obvious roles (asset owners, risk owners, incident responders, those who grant access) and the less obvious ones: who decides an exception, who reviews it, who is accountable when a supplier fails.

The clause 5.3 requirement is the management-system half of this; A.5.2 is the operational half, reaching into the organisation rather than sitting at the top of it.

Where it usually breaks is at the edges — a responsibility allocated to a team rather than a role, so nobody in the team holds it; or allocated to a role that no longer exists after a reorganisation, which is why allocation has to be revisited when the organisation changes rather than when the policy is next reviewed.

How to put this in place

The ISMS creates security tasks that cross teams, and a task nobody owns does not get done. Assigning roles early stops work from falling between IT, HR and the business.

  1. List the security activities your ISMS and chosen controls create.
  2. Assign each activity to a role rather than a named person.
  3. Record the assignments in a responsibility matrix and add them to job descriptions where they matter.
  4. Tell the people concerned and have top management confirm the ISMS manager role.
  5. Update the matrix when people join, move or leave.

Evidence an auditor usually looks for: the responsibility matrix, the appointment of the ISMS manager, and role holders who can explain their duties when asked.

What is in the packs for this

Each one helps with this requirement.

  • Excel

    Annex A Control Implementation Library

    in ISO 27001 Implementation & Certification ReadinessIts row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
  • Excel

    Statement of Applicability Template

    in ISO 27001 Implementation & Certification ReadinessHas its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.
  • Excel

    Mandatory ISMS Documentation Checklist

    in ISO 27001 Implementation & Certification ReadinessAnnex A Documents sheet: lists security roles and responsibilities among the documents auditors commonly expect for this control.
  • Excel

    Exception & SoD Responsibility Matrix

    in Security Exception, Waiver & Segregation of DutiesIts Framework References list this control. Supported by: Responsibility Matrix: one accountable role per activity.
  • Excel

    Policy Development & Approval Responsibility Matrix

    in Security Policy ManagementIts Framework References list this control. Supported by: Responsibility Matrix: one accountable role per activity.
  • Excel

    Metric Ownership Responsibility Matrix

    in Cybersecurity Metrics & Reporting ProgrammeIts Framework References list this control. Supported by: Responsibility Matrix and Role Holders: the four duties for every metric, assigned to named roles.
  • Excel

    Identity Lifecycle Responsibility Matrix

    in Joiner-Mover-Leaver & Access ProvisioningIts Framework References list this control. Supported by: Responsibilities and Role Holders: identity lifecycle duties assigned to named roles, with one accountable role per activity.
  • Excel

    Information Ownership Responsibility Matrix

    in Information Classification & HandlingIts Framework References list this control. Supported by: Responsibilities and Role holders: information security roles and responsibilities defined and allocated.
  • Excel

    AI Governance Responsibility Matrix

    in AI Security Governance & Acceptable UseIts Framework References list this control. Supported by: Responsibilities and Role holders: information security roles and responsibilities defined and allocated, with one accountable role for each AI activity.
  • Word

    Security Function Handover Document

    in CISO Transition, Handover & First 90 DaysIts Framework References list this control. Supported by: Roles and responsibilities: the form states each role and authority the outgoing leader held, and who takes it.
  • Excel

    Transition Decision Rights Matrix

    in CISO Transition, Handover & First 90 DaysIts Framework References list this control. Supported by: Decision Rights, Responsibilities and Role Holders: security roles and responsibilities allocated for the transition, with one accountable role for each activity.