ISO 27001 Information Security - Clause 5.3 Organizational roles, responsibilities and authorities

Organizational roles, responsibilities and authorities

Information Security roles, responsibilities and authorities must be determined, assigned to people, and communicated to them. For example, there may be an 'Information Security Manager' or 'Compliance Manager' with assigned responsibility and authority for:

• Ensuring that the system complies to ISO 27001
• Reporting on the ISMS to top management
• Ensuring the integrity of the ISMS as part of change management

That person may be assisted by others such as the IT team, Privacy Officer, and internal auditors. Any of those people may also have other responsibilities and job titles.

Apart from what may be considered as the 'key players' in the management system, everyone else who works for the organization also has a part to play in its success. Therefore, you should define and document the relevant responsibilities for others. That may be achieved in job descriptions, and relevant procedures and plans.

Individual workers should be provided with a copy of their job description and be asked to sign a copy for retention by the organization.

For very small companies, an alternative to a system of job descriptions may be to simply list responsibilities in an ISMS Overview document. Responsibilities for certain actions may also be summarised in procedures or plans. Naturally, these should be compatible with any job descriptions that do exist.

There is a subtle difference between authority and responsibility.

• Responsibilities may be considered as the duties assigned to a job position. For example: The Human Resources or People & Culture Manager may be responsible for ensuring the approporiate screening of new employees
• The authority vested in a job position refers to the powers of decision that have been delegated to a person in that position e.g. approval of purchases of a certain type, approval of access rights etc. Once again, these may be listed in individual job descriptions. However, an alternative method is a 'List of Delegated Authorities' that describes the levels of authority vested in all job positions. This has the advantage that when there are changes to authorities, only one document needs to be changed - not a whole stack of job descriptions.

Templates for Job Descriptions and a 'List of Delegated Authorities' are part of ISO 27001 InfoSec Toolkit which is included in Qudos 3 IMS software.

The previous blog post in this series is ISO 27001 Clause 5.2 Policy

The next blog in this series is on Clause 6.1 Actions to address risks and opportunities.