ISO 27001:2022 Clause 5.3 Organisational Roles, Responsibilities and Authorities Explained

In this guide you will learn how to implement ISO 27001 Clause 5.3 Organisational Roles, Responsibilities and Authorities and pass your audit from ISO 27001 Lead Auditor Stuart Barker – author of the ultimate ISO 27001 Toolkit.

ISO 27001 Clause 5.3 Roles and Responsibilities is an ISO 27001 control that requires you to define roles and responsibilities relevant to your information security management system (ISMS) and allocate them to people.

Purpose & Definition

The purpose of ISO 27001 clause 5.3 is to make sure you have defined, assigned and communicated the roles and responsibilities that you need to run your information security management system to people. This will ensure that the management system is effective.

The ISO 27001 standard defines ISO 27001 clause 5.3 as:

Top management shall ensure that the responsibilities and authorities for roles relevant to information security are assigned and communicated within the organisation. Top management shall assign the responsibility and authority for: a) ensuring that the information security management system conforms to the requirements of this document b) reporting on the performance of the information security management system to top management.

ISO 27001:2022 Clause 5.3 Organisational roles, responsibilities and authorities

FREE ISO 27001 Clause 5.3 Training Video

In this free training video I show you how to implement ISO 27001 Clause 5.3 Roles and Responsibilities and how to pass your audit.

Implementation Guidance

Identify the roles that you need

You identify the roles that you need to implement, run and manage your information security management system. To do this you would either take a list of known roles or you would work out what needs doing and the roles that you need to support that.

You are going to work with top management to make sure that you have defined and allocated roles and responsibilities for information security.

The first step is for you to nominate someone to be the information security manager who will be responsible for the information security management system.

Allocate people to roles

With the roles and responsibilities defined and documented it is now time to allocate people to those roles. Roles can be assigned to people outside the organisation if it is practicable and applicable to you.

In a small organisation it may well be the case that one individual is assigned more than one role and that is absolutely fine.

The only requirements is to maintain segregation of duties, which is covered in detail in ISO 27001 Annex A 5.3 Segregation of duties.

You have the following options when assigning people

• Get external help
• Appoint someone internally
• Train someone

You must ensure that the people you assign are competent to take on the roles and that you have not introduced any conflict of interest (ISO 27001 Annex A Control 5.3 Segregation of duties)

Assign the Management Review Team

A management review team has certain responsibilities within the management system.

Document the Management Review Team in the Information Security Roles Assigned and Responsibilities and document that it has responsibility for overseeing the Information Security Management System.

The Management Review Team should be made up of one representative of each of the in scope areas and those representatives should have an assigned deputy. In addition, at least one member of the senior management team and leadership team is part of this Management Review Team.

This group reports to the board and has board representation and certain board designated authority for decision making.

The Management Review Team meeting should meet at least quarterly and follow the agenda as defined in the standard.

Further guidance is provided in the guide How to conduct an ISO 27001 Management Review Meeting.

Typical duties of the Management Review Team include:

• Approval and sign off of policy
• Approval and sign off of processes
• Risk Management Oversight
• Continual Improvement Oversight
• Performance Evaluation of the Information Security Management System (ISMS)

Manage Competence

To manage competence you will complete an ISO 27001 competence matrix.

This is for every member of the management structure, for everybody that’s involved in Information Security Management and its delivery. It will cover everybody documented in the roles and responsibilities document and in the ISO 27001 RASCI Matrix

The basic concept of a Competency Matrix is you are demonstrating that you have the competencies to run an effective management system. You will use it to plan training to address gaps.

How to implement ISO 27001 Clause 5.3

Roles and Responsibilities ISO 27001 Clause 5.3 Implementation Checklist:

1. Identify Key Roles

Determine the essential roles needed for effective ISMS implementation and operation. This includes roles like Information Security Manager, Data Owners, System Administrators, etc.

Challenge: Overlooking crucial roles or creating unnecessary complexity.

Solution: Conduct a thorough analysis of the organisation’s information security needs and structure. Use a RACI matrix (Responsible, Accountable, Consulted, Informed) to define roles and their relationships.

2.Define Responsibilities for Each Role

Clearly define the specific responsibilities associated with each identified role. What are they expected to do?

Challenge: Vague or overlapping responsibilities, leading to confusion and gaps in coverage.

Solution: Document responsibilities in detail, using clear and concise language. Ensure that each responsibility is assigned to only one role to avoid ambiguity.

3. Assign Authorities to Match Responsibilities

Grant the necessary authority to individuals so they can effectively carry out their assigned responsibilities. Authority should match the level of responsibility.

Challenge: Giving responsibility without the corresponding authority, hindering performance.

Solution: Clearly define the limits of authority for each role. Ensure that individuals understand their authority levels and are empowered to act within those limits.

4. Document Roles, Responsibilities, and Authorities

Maintain documented information about the defined roles, responsibilities, and authorities. This can be in the form of job descriptions, role profiles, or a dedicated RACI matrix.

Challenge: Difficulty in keeping documentation up-to-date and accessible.

Solution: Use a centralised document management system to control versions and access. Establish a regular review process to ensure accuracy.

5. Communicate Roles and Responsibilities

Ensure that all relevant personnel are aware of their own roles and responsibilities, as well as those of others.

Challenge: Employees not understanding their roles or how they contribute to the ISMS.

Solution: Conduct training and awareness programs to communicate roles and responsibilities. Make the documentation easily accessible.

6. Provide Training and Competence Development

Ensure that individuals have the necessary skills and knowledge to fulfil their assigned responsibilities.

Challenge: Lack of skilled personnel or difficulty in providing adequate training.

Solution: Conduct skills gap analysis and develop training plans to address identified gaps. Provide opportunities for professional development and certifications.

7. Integrate Roles into ISMS Processes

Ensure that defined roles are integrated into the ISMS processes, such as risk assessment, incident management, and internal audit.

Challenge: Roles not being actively involved in ISMS processes.

Solution: Clearly define the involvement of each role in relevant processes. Include roles in process documentation and training.

8. Regularly Review Roles and Responsibilities

Periodically review the defined roles and responsibilities to ensure they remain relevant and effective. Business needs and the ISMS itself evolve.

Challenge: Roles becoming outdated or not aligned with current needs.

Solution: Conduct regular reviews, at least annually or more frequently as needed. Involve key stakeholders in the review process.

9. Address Performance Gaps

Have a process in place to address performance gaps related to information security responsibilities.

Challenge: Difficulty in addressing performance issues or lack of clear performance expectations.

Solution: Establish clear performance expectations for each role. Provide regular feedback and coaching. Implement a performance management process to address performance gaps.

10. Maintain Organisational Structure Chart

While not strictly required by 27001, a high-level organisational chart showing reporting lines for key security roles can be beneficial.

Challenge: Keeping the organisational chart current, especially in dynamic environments.

Solution: Assign responsibility for maintaining the organisational chart. Integrate updates into the change management process.

ISO 27001 Roles and Responsibilities Template

Document the Information Security Roles Assigned and Responsibilities and set out the roles and responsibilities with allocated resource.

ISO 27001 Management Review Template

Implement a Management Review Team with representatives from across the business and ensure meetings follow the structured Management Review Team Agenda.

ISO 27001 Competence Template

Document a Competency Matrix to capture the core competencies and training requirements of staff in relation to information security.

Example ISO 27001 Responsibilities and Responsibilities

Example roles and responsibilities in the information security management system include:

CEO

• Sets the company direction for information security
• Promotes a culture of information security aligned to the business objectives
• Signs off and agrees on resources, objectives, risks and risk treatment

Information Security Management Leadership

• A central point of ownership to oversee the information security management system effectiveness.

The Information Security Manager

• Day to day operation of the information security management system
• Develop and continually improve the information security management system documentation
• Conduct a structured audit programme of all areas of the Information Security management system based on risk at least annually
• Provide training and awareness to all staff on information security
• Report to the management review team as part of the structured agenda, as a minimum covering audit results, incidents, new risk, update on assigned risks and continual improvements.
• Manage the continual improvement process
• Manage the periodic update and review of documentation
• Attend and co-ordinate internal information security management audit
• Manage the completion received third party questionnaires in relation to information security from suppliers and clients
• Maintain or have access to a list of all security related incidents
• Provide guidance and support on matters relating to information security

The Management Review Team

The management review team shall review the organisation’s information security management system at planned intervals to ensure its continuing suitability, adequacy and effectiveness.


• Signs off policies and documents related to the information security management system
• Oversees the risk management process and risk register
• Signs off and agrees / escalates risk mitigation for information security risks
• Ensures resources are available to implement identified, agreed risk mitigation
• Implements policies, processes and continual improvements of the information security management system
• Reports on projects or internal and external factors that may influence the information security management system
• Communicates information security to the organisation

The Third Party Manager

• Ensures effective third-party management of all suppliers and third parties in line with the third-party management policies and processes
• Owns the third-party supplier register
• Reports progress on third party management as a minimum to the management review team

How to pass the ISO 27001 Clause 5.3 audit

To pass an audit of ISO 27001 Clause 5.3 Roles and Responsibilities you are going to

• Decide what roles you need
• Allocate roles to people
• Ensure people are competent to perform the role
• Implement a Management Review Team
• Document it

What an auditor looks for

The ISO 27001 certification body auditor is going to check a number of areas for compliance with ISO 27001 Clause 5.3 Organisational Roles, Responsibilities and Authorities. Lets go through them:

• That you have documented roles and responsibilities: This is the easiest one for them to check. They want to see that roles and responsibilities have been defined and allocated. The easiest way is to use the ISO 27001 Roles and Responsibilities Template. The main roles they want to see documented are the information security manager and the management review team.
• That people allocated are still in the organisation: This is an easy one for them as most people do not keep their documentation up to date and as a result there will be people documented as being allocated to roles that no longer work in the organisation. 3. That people are competent to perform the role
• It isn’t enough to document and allocate roles. The roles that are allocated need to be allocated to people that are competent to perform the role. This not a tick box and documentation exercise, it is about getting the management system operating effectively with people that are experienced and know what they are doing.

Common Mistakes and How to avoid them

In my experience, the top 3 mistakes people make for ISO 27001 Clause 5.3 Organisational Roles, Responsibilities and Authorities are:

The Mistake	Why it Fails the Audit	The Auditor’s Solution
1. Vague or Generic Job Titles Stating “The IT Department is responsible for security” instead of naming specific roles.	Auditors cannot establish accountability. If everyone is responsible, no one is responsible. It leads to critical security controls falling through the cracks.	Document explicit roles using an ISO 27001 RASCI Matrix. Assign a specific, named individual to be accountable for every single Annex A control.
2. The Communication Black Hole Defining roles perfectly in a Word document, but failing to tell the rest of the business who they are.	The 2022 standard explicitly demands roles are communicated “within the organisation.” If I ask a random employee who the Information Security Manager is and they do not know, you will receive a non-conformity.	Broadcast your security organisational chart on the company intranet, include it in mandatory staff onboarding, and track digital policy acknowledgements.
3. Authority vs. Responsibility Mismatch Making someone responsible for incident response, but failing to give them the system permissions or executive authority to actually execute it.	You have created a scapegoat, not a security leader. “Authorities” is literally in the clause title: you must prove the assigned role has the technical and administrative power to act.	Align documented job descriptions directly with your Identity and Access Management (IAM) system permissions and ensure the role has a direct reporting line to Top Management.

Further Reading

• ISO 27001 Competency Matrix Beginner’s Guide
• How to conduct an ISO 27001 Management Review Meeting
• ISO 27001 Roles and Responsibilities Explained