.png)
ISO27001 states that “Information security roles and responsibilities shall be defined and allocated according to the organisations needs” (A5.2 Roles and Responsibilities).
You may have a lot of this information contained within your job descriptions and contracts, but having a specific document that outlines key responsibilities for information security is a great addition.
This document will help you establish the roles and responsibilities of;
- Senior leadership
- The Management Review Team
- Senior Management
- Information Security Manager(s)
- Information Asset Owners
- All employees
You might want to add to this document any other specific groups within your business, such as the Incident Management Team, or Change Management.
Remember this is in addition to your job descriptions and contracts.
This document
All our documents are designed with simplicity in mind. But in their simplicty they meet the both the standards, and your needs. Using these as a springboard towards continual improvement and see your security management system develop and thrive.
Security Roles and Responsibilities
Hey, we're not going to go all 'legal' on you here... that's not our style. But this is our Intellectual Property, and we'd prefer it if you didn't go sharing this with other people who haven't spent the money and bought a copy.
Of course, we can't really stop you... But are you that kind of person? We don't think you are. So if you want to tell people about your new found super power of ISO27001-Awesomeness, great... just don't give it away for free!