ISO 27002:2022 5.2: Information security roles and responsibilities

Information security roles and responsibilities are to be set out and assigned to people in a way that fits what the organization needs. Purpose: create an agreed, approved structure, understood by everyone, for putting information security in place, running it and managing it. Guidance: assignments follow the information security policy and the topic-specific policies, and cover who protects information and associated assets, who carries out particular security processes, who performs risk management and especially who accepts residual risk (such as risk owners), and the duties of everyone who uses the organization's information and assets. Site-level or facility-level detail is added where needed. A person holding a security responsibility may hand tasks to someone else but stays accountable and should confirm the delegated work was done properly. Each area of responsibility is defined, written down and communicated, and authorization levels are documented. People in security roles need the knowledge and skills the role demands and should get support to stay current. Other information notes that many organizations name an information security manager with overall responsibility, that resourcing and implementation often stay with line managers, that asset owners commonly carry day-to-day protection, and that in smaller organizations security may be part of existing jobs rather than a dedicated post.