Frameworks / ISO 22301:2019 / 5.3 ISO 22301:2019
Leadership, ISO 22301:2019
ISO 22301:2019 5.3: Roles, responsibilities and authorities Top management must assign and communicate the responsibilities and authorities for the roles the BCMS depends on, and must specifically assign responsibility and authority for ensuring the BCMS conforms to the standard and for reporting BCMS performance back to top management.
Maintained by Gerard Blokdyk · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 80 controls across 41 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
1.1.2 1.1.2 Requirement 1 roles and responsibilities assigned 11.1.2 11.1.2 Roles for security testing assigned and understood 12.1.1 12.1.1 Overall information security policy established and disseminated 12.1.4 12.1.4 Executive ownership of information security formally assigned 12.8.5 12.8.5 Responsibility allocation between entity and TPSPs 2.1.2 2.1.2 Requirement 2 roles and responsibilities assigned 4.1.2 4.1.2 Requirement 4 roles and responsibilities assigned 5.1.2 5.1.2 Requirement 5 roles and responsibilities assigned 6.1.2 6.1.2 Requirement 6 roles and responsibilities assigned 7.1.2 7.1.2 Requirement 7 roles and responsibilities assigned 9.1.2 9.1.2 Requirement 9 roles and responsibilities assigned 3.1.2 3.1.2 Assigned duties for Requirement 3 activities 8.1.2 8.1.2 Requirement 8 roles and responsibilities assigned SOC2-CC1.3 CC1.3 Structures, reporting lines, authorities and responsibilities (COSO principle 3) SOC2-CC1.5 CC1.5 Accountability for internal control responsibilities (COSO principle 5) SOC2-CC2.2 CC2.2 Internal communication of objectives and control responsibilities (COSO principle 14) SOC2-CC5.3 CC5.3 Deploying controls through policies and procedures (COSO principle 12) CPS230-13 Board Accountability for Operational Risk Management CPS230-14 Board Setting of Senior Manager Roles and Responsibilities 20 Para 20 Board ensures clear senior manager roles for operational risk, continuity and service providers 5.2 Information security roles and responsibilities 5.3 Segregation of duties 5.4 Management responsibilities 5.2 Information security roles and responsibilities 5.3 Segregation of duties 5.4 Management responsibilities C5-BCM-01 Top management responsibility C5-OIS-01 Information Security Management System (ISMS) CIS-17.1 Designate Personnel to Manage Incident Handling CIS-17.5 Assign Key Roles and Responsibilities CP-2 Contingency Plan PS-9 Position Descriptions (PS-9) CP-2 Contingency Plan PS-9 Position Descriptions (PS-9) 5.3 Leadership 5.3.3 Organizational roles, responsibilities and authorities ISO-37002-5.3 Organizational roles, responsibilities and authorities ISO37002-5.3 Roles, Responsibilities, Authorities ISO-41001-5.3 Organizational roles, responsibilities and authorities ISO41001-5.3 Roles, Responsibilities, and Authorities ISO-56002-5.4 Organizational roles, responsibilities and authorities ISO56002-5.3 Organizational roles, responsibilities and authorities 27003-5.3 Roles, Responsibilities, Authorities ISO27003-5.3 Organizational roles, responsibilities and authorities 161R1-PM-2 Information Security Program Leadership Role 161R1-PM-29 Risk Management Program Leadership Roles CPS234-14 Definition of Information Security Roles and Responsibilities AS9100D-5.3 Organizational Roles, Responsibilities, and Authorities CFTC-SS-2 Enterprise Risk Management and Governance Category 5.3 Organizational roles, responsibilities and authorities 5.3 Organizational roles, responsibilities and authorities 5.4.1 Roles and responsibilities of the individual(s) managing the audit programme 5.3 Organizational roles, responsibilities and authorities ISO-22313-5.3 Organizational roles, responsibilities and authorities ISO22320-4.2 Roles, Responsibilities, and Authorities A.5.1 A.5.1 Resources, roles, responsibility and authority for resilience management ISO30401-5.3 Roles, responsibilities, authorities 5.3 5.3 Organizational roles, responsibilities and authorities 5.3 Roles, responsibilities and authorities ISO-39001-5.3 Organizational roles, responsibilities and authorities 5.3 Organizational roles, responsibilities and authorities ISO-50001-5.3 Organizational roles, responsibilities and authorities 5.3 Organizational roles, responsibilities and authorities 5.3 Organizational roles, responsibilities and authorities 23894-5.4.3 Roles, Authorities, Responsibilities 5.3 Roles, responsibilities and authorities NIST-CSF-GV.RR-02 Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in Leadership, ISO 22301:2019 You are reading one control. How much of ISO 22301:2019 have you already done? ISO 22301:2019 5.3 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 22301:2019 your existing evidence covers. Hold APRA CPS 230 Operational Risk Management and 28 of 57 ISO 22301:2019 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the APRA CPS 230 Operational Risk Management pair alone.
Query this from an agent The graph holds this control, the 80 it maps to, and the evidence behind each claim, over MCP and REST.