ISO/IEC 42001:2023
Leadership – ISO/IEC 42001:2023

ISO/IEC 42001:2023 5.3: Roles, responsibilities and authorities

Top management must make sure relevant roles have their responsibilities and authorities allocated and made known, and must assign responsibility and authority for keeping the AIMS conformant with the standard and for reporting AIMS performance to top management (control A.3.2 addresses AI roles).

Maintained by Gerard BlokdykControl text last updated

What else in your programme already covers this

This control maps to 66 controls across 34 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

PCI DSS 4.0 · 12 controls

  • 1.1.2 1.1.2 Requirement 1 roles and responsibilities assigned
  • 11.1.2 11.1.2 Roles for security testing assigned and understood
  • 12.1.4 12.1.4 Executive ownership of information security formally assigned
  • 12.8.5 12.8.5 Responsibility allocation between entity and TPSPs
  • 2.1.2 2.1.2 Requirement 2 roles and responsibilities assigned
  • 4.1.2 4.1.2 Requirement 4 roles and responsibilities assigned
  • 5.1.2 5.1.2 Requirement 5 roles and responsibilities assigned
  • 6.1.2 6.1.2 Requirement 6 roles and responsibilities assigned
  • 7.1.2 7.1.2 Requirement 7 roles and responsibilities assigned
  • 9.1.2 9.1.2 Requirement 9 roles and responsibilities assigned
  • 3.1.2 3.1.2 Assigned duties for Requirement 3 activities
  • 8.1.2 8.1.2 Requirement 8 roles and responsibilities assigned

NIST SP 800-53 Rev 5 · 10 controls

ISO 27002:2022 · 4 controls

  • 5.2 Information security roles and responsibilities
  • 5.24 Information security incident management planning and preparation
  • 5.3 Segregation of duties
  • 5.4 Management responsibilities

ISO 27001:2022 · 3 controls

  • 5.2 Information security roles and responsibilities
  • 5.3 Segregation of duties
  • 5.4 Management responsibilities

ISO 27701:2019 · 2 controls

  • 5.3 Leadership
  • 5.3.3 Organizational roles, responsibilities and authorities

ISO 37002:2021 - Whistleblowing Management Systems · 2 controls

  • ISO-37002-5.3 Organizational roles, responsibilities and authorities
  • ISO37002-5.3 Roles, Responsibilities, Authorities

ISO 41001:2018 - Facility Management Systems · 2 controls

  • ISO-41001-5.3 Organizational roles, responsibilities and authorities
  • ISO41001-5.3 Roles, Responsibilities, and Authorities

ISO 56002 · 2 controls

  • ISO-56002-5.4 Organizational roles, responsibilities and authorities
  • ISO56002-5.3 Organizational roles, responsibilities and authorities

ISO/IEC 27003:2017 · 2 controls

  • 27003-5.3 Roles, Responsibilities, Authorities
  • ISO27003-5.3 Organizational roles, responsibilities and authorities

NSW AI Operational Policy (2026) · 2 controls

  • 4.2 4.2 Designate an Accountable Official and notify NSW GovAI
  • 5.2 5.2 Accountable Official accountabilities

SOC 2 · 2 controls

  • SOC2-CC1.2 CC1.2 Board independence and oversight of internal control (COSO principle 2)
  • SOC2-CC1.3 CC1.3 Structures, reporting lines, authorities and responsibilities (COSO principle 3)

AS9100D - Aerospace Quality Management System · 1 control

  • AS9100D-5.3 Organizational Roles, Responsibilities, and Authorities

CIS Controls v8 · 1 control

  • CIS-17.1 Designate Personnel to Manage Incident Handling

CMMC 2.0 · 1 control

HIPAA Security Rule · 1 control

ISO 14001:2015 · 1 control

  • 5.3 Organizational roles, responsibilities and authorities

ISO 14004:2016 · 1 control

  • 5.3 Organizational roles, responsibilities and authorities

ISO 19011:2018 · 1 control

  • 5.4.1 Roles and responsibilities of the individual(s) managing the audit programme

ISO 22000:2018 · 1 control

  • 5.3 Organizational roles, responsibilities and authorities

ISO 22301:2019 · 1 control

  • 5.3 Roles, responsibilities and authorities

ISO 22313:2020 - Guidance on Business Continuity Management Systems · 1 control

  • ISO-22313-5.3 Organizational roles, responsibilities and authorities

ISO 22320:2018 · 1 control

  • ISO22320-4.2 Roles, Responsibilities, and Authorities

ISO 30401 · 1 control

  • ISO30401-5.3 Roles, responsibilities, authorities

ISO 37001:2016 · 1 control

  • 5.3 5.3 Organizational roles, responsibilities and authorities

ISO 37301:2021 · 1 control

  • 5.3 Roles, responsibilities and authorities

ISO 39001:2012 - Road Traffic Safety Management · 1 control

  • ISO-39001-5.3 Organizational roles, responsibilities and authorities

ISO 45001:2018 · 1 control

  • 5.3 Organizational roles, responsibilities and authorities

ISO 50001:2018 - Energy Management Systems · 1 control

  • ISO-50001-5.3 Organizational roles, responsibilities and authorities

ISO 55001:2014 · 1 control

  • 5.3 Organizational roles, responsibilities and authorities

ISO 9001:2015 · 1 control

  • 5.3 Organizational roles, responsibilities and authorities

ISO/IEC 23894:2023 · 1 control

  • 23894-5.4.3 Roles, Authorities, Responsibilities

NIST Cybersecurity Framework 2.0 · 1 control

  • NIST-CSF-GV.RR-02 Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced

NIST SP 800-218 · 1 control

NIST SP 800-66 Rev 2 · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Leadership – ISO/IEC 42001:2023

You are reading one control. How much of ISO/IEC 42001:2023 have you already done?

ISO/IEC 42001:2023 5.3 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO/IEC 42001:2023 your existing evidence covers. Hold NIST AI Risk Management Framework (AI RMF 1.0) and 30 of 38 ISO/IEC 42001:2023 controls already carry evidence.

If you hold NIST AI Risk Management Framework (AI RMF 1.0)78.9% covered · 8 gapsIf you hold EU AI Act57.9% covered · 16 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the NIST AI Risk Management Framework (AI RMF 1.0) pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 66 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll ISO/IEC 42001:2023 controls