ISO 27001 A.5.2 - Information Security Roles and Responsibilities

Requirement

Information security roles and responsibilities must be defined and allocated according to organizational needs.

Plain-language meaning

People must know what they are responsible for, and the organization must be able to prove those responsibilities were assigned, communicated, accepted, and kept current.

This control is not just about appointing a CISO. It applies to:

• employees;
• contractors;
• temporary workers;
• third-party users;
• managers;
• technical administrators;
• asset owners;
• process owners;
• risk owners;
• outsourced service providers.

Core idea

The organization must clearly define:

• who owns information security overall;
• who owns specific assets;
• who owns risks;
• who approves access;
• who monitors systems;
• who handles incidents;
• who manages third parties;
• who performs reviews;
• who maintains policies;
• who reports issues;
• who has authority to make security decisions.

A common failure is assuming “security belongs to the security team.” That does not scale.

Role, responsibility, accountability, authority

Important rule:

Responsibility can be delegated, but accountability remains with the accountable owner unless formally reassigned.

Why this matters

Unclear responsibilities create gaps.

The phrase “everyone is responsible for security” is not enough. It must be supported by specific role-level responsibilities.

Implementation guidance

1. Assign overall responsibility for information security

There should be a person or function responsible for information security, such as:

• Chief Information Security Officer;
• Head of Information Security;
• ISMS Manager;
• Security Officer;
• Information Security Lead.

In smaller organizations, this may be part-time or combined with another role. That can be acceptable if responsibilities are clear and conflicts of interest are managed.

2. Separate security leadership from risk ownership

The person responsible for information security may not be the same as the person who owns information risk.

The CISO should not be forced to own every business risk. Security can advise and challenge, but business owners should own risks in their area.

3. Define baseline responsibilities for all personnel

All employees, contractors, and third-party users should have basic security responsibilities.

Examples:

• follow information security policies;
• protect credentials;
• report suspected incidents;
• use company systems appropriately;
• protect confidential information;
• complete required training;
• comply with classification and handling rules;
• avoid unauthorized software or data sharing;
• follow clean desk, remote work, and acceptable use requirements.

Baseline responsibilities may be documented in:

• job descriptions;
• employee handbook;
• employment contracts;
• acceptable use policy;
• onboarding materials;
• annual policy acknowledgement;
• security awareness training.

4. Define detailed responsibilities for special roles

Some roles need more detail because they have elevated access or direct control over important systems.

For these roles, general statements are not enough.

5. Communicate responsibilities

Responsibilities should be communicated through:

• onboarding;
• job descriptions;
• contract terms;
• security training;
• policy acknowledgement;
• team briefings;
• role-specific training;
• procedure walkthroughs;
• performance objectives;
• third-party onboarding.

6. Keep responsibilities consistent with policies and procedures

Responsibilities in policies, procedures, job descriptions, RACI matrices, and contracts must not conflict.

Example of conflict:

Better model:

7. Update responsibilities when roles change

Examples:

Changes should be communicated promptly and supported with appropriate training.

8. Manage delegation correctly

Delegation must be explicit and verified.

Define:

• what is delegated;
• to whom;
• for how long;
• what authority is included;
• what reporting is required;
• how completion is verified.

Bad delegation:

Security is handling it.

Better delegation:

The Infrastructure Manager is responsible for remediating critical server vulnerabilities within the agreed SLA. The Head of IT remains accountable for remediation performance and reports status monthly to the risk committee.

9. Include contractors and third parties

Temporary employees, contractors, and third-party users must have defined security responsibilities.

This may be handled through:

• contracts;
• statements of work;
• supplier security schedules;
• onboarding packs;
• acceptable use agreements;
• NDAs;
• access agreements;
• third-party security requirements;
• SLAs;
• incident notification clauses.

Accountability problems to watch for

Overlapping responsibility without primary accountability is dangerous.

Shared responsibility is normal. Shared accountability is dangerous unless one owner is primary.

Audit guidance

Auditors check whether responsibilities are:

• defined;
• allocated;
• documented;
• communicated;
• understood;
• current;
• consistent;
• accepted;
• applied to employees, contractors, and third parties.

Audit tests

Strong evidence

• Approved information security organizational structure.
• Named CISO, ISMS Manager, or security owner.
• Job descriptions include security responsibilities.
• Privileged roles have specific security duties.
• Employees have acknowledged policies and responsibilities.
• Contractors have signed acceptable use and confidentiality obligations.
• Third-party contracts include security responsibilities.
• RACI matrix defines accountable owners for key ISMS processes.
• Access control, incident management, supplier management, and risk responsibilities are consistent across documents.
• Role changes trigger updated responsibilities and training.
• Security objectives included in performance reviews for relevant roles.

Weak evidence

• “Everyone knows what to do.”
• Security responsibilities exist only in a generic policy.
• No named owner for information security.
• CISO owns everything, including business risk acceptance.
• Contractors have system access but no documented responsibilities.
• Job descriptions are outdated.
• Responsibilities in policy conflict with procedures.
• No evidence employees received or accepted responsibilities.
• Multiple teams are listed as responsible, but no one is accountable.
• Outsourced provider is responsible for controls, but no internal owner manages the provider.

Common failures

Exam traps

• Only the security team needs defined responsibilities — wrong.
• Appointing a CISO alone satisfies the control — wrong.
• Delegating responsibility transfers accountability — wrong.
• Contractors and temporary workers are exceptions — wrong.
• General statements are enough for high-risk roles — wrong.
• Shared responsibility means shared accountability — risky and usually weak.

KB-ready summary

A.5.2 requires security roles and responsibilities to be defined, allocated, communicated, accepted, and kept current. Baseline responsibilities apply to all personnel, while high-risk roles need specific documented responsibilities. Delegated tasks must be verified, accountability must remain clear, and contractors and third parties must be included.

Templates and checklists

• Information Security Role Definition
• Security Responsibilities Addendum
• Control Owner Register
• RACI Matrix
• A.5.2 Audit Checklist
• Role and Responsibility Interview Questions