Information security roles and responsibilities

What the control asks

Information security roles and responsibilities are to be set out and assigned to people in a way that fits what the organization needs. Purpose: create an agreed, approved structure, understood by everyone, for putting information security in place, running it and managing it. Guidance: assignments follow the information security policy and the topic-specific policies, and cover who protects information and associated assets, who carries out particular security processes, who performs risk management and especially who accepts residual risk (such as risk owners), and the duties of everyone who uses the organization's information and assets. Site-level or facility-level detail is added where needed. A person holding a security responsibility may hand tasks to someone else but stays accountable and should confirm the delegated work was done properly. Each area of responsibility is defined, written down and communicated, and authorization levels are documented. People in security roles need the knowledge and skills the role demands and should get support to stay current. Other information notes that many organizations name an information security manager with overall responsibility, that resourcing and implementation often stay with line managers, that asset owners commonly carry day-to-day protection, and that in smaller organizations security may be part of existing jobs rather than a dedicated post.

Purpose in the standard’s terms, in our words: Creates an approved, understood structure for implementing, operating and managing information security.

Attribute values in one line: Preventive; Confidentiality, Integrity, Availability; Identify; Governance; Governance and ecosystem, Protection, Resilience.

The five attribute values

These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.

Evidence an auditor asks for

The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.

• A documented roles and responsibilities matrix covering asset protection, specific security processes, risk management and residual risk acceptance, and user duties
• Named risk owners with evidence that they accepted residual risks
• Documented authorization levels for each security role
• Records showing delegated security tasks and the accountable person's confirmation that they were completed correctly
• Competence requirements for security roles with training or certification records and ongoing development
• Site-specific or facility-specific responsibility supplements where the organization operates several locations

Where audits commonly find gaps

• Residual risk is accepted by the security team rather than by the business risk owner
• Responsibilities are defined in a policy but not communicated to the people who hold them
• Delegation happens without any check that the delegated task was performed
• People in security roles have no defined competence requirement or development plan

What ISO/IEC 27028 changes for this control

It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. Its earlier numbering (06.1.1) is kept in the register so an older audit file can still be traced. It serves more than one security domain, which is why a domain count taken by row understates the view.

The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.

Controls that share its values

• 5.1 Policies for information security
• 5.8 Information security in project management
• 5.19 Information security in supplier relationships

Read the five attributes All 93 controls