# About Clause 5.3: Organizational roles, responsibilities and authorities

Top management must make sure that responsibilities and authorities for information security roles are assigned and communicated within the organization.

Top management specifically needs to assign responsibility and authority for ensuring the ISMS's compliance with the standard, and for reporting[^1] on it's performance (apparently, assigning *other* responsibilities and authorities need *not* be a top management concern).

[Original Text](../ISO-27001-OST/ISO27001-EN-2022/ISO_27001_2022_OT%205.3%20Organizational%20roles,%20responsibilities%20and%20authorities.md)

[[ISO_27001_PE 5.3 Organizational roles, responsibilities and authorities\|Plain English]]

[PECB Auditor training: Leadership](../../../../👩🏼‍⚖️%20Standards%20and%20Regulations/ISO%2027K/PECB%20Lead%20Auditor%20Training%2027001/PECB%2027001%20LA%20S05%20E01b%20-%20Leadership.md)



[^1]: Note that 'reporting' (5.3b) means carrying responsibility and being accountable (for the performance of the ISMS), not just giving information.
