#iso27002/2022/EN
## 5.2 Information security roles and responsibilities

### Control
Information security roles and responsibilities should be defined and allocated according to the organization needs.

### Purpose
To establish a defined, approved and understood structure for the implementation, operation and management of information security within the organization.

### Guidance
Allocation of information security roles and responsibilities should be done in accordance with the information security policy and topic-specific policies (see [5.1](ISO_27002_2022_5.1_OT%20Policies%20for%20information%20security.md)). The organization should define and manage responsibilities for:

a)   protection of information and other associated assets;
b)   carrying out specific information security processes;
c)   information security risk management activities and in particular acceptance of residual risks (e.g. to risk owners);
d)   all personnel using an organization’s information and other associated assets.

These responsibilities should be supplemented, where necessary, with more detailed guidance for specific sites and information processing facilities. Individuals with allocated information security responsibilities can assign security tasks to others. However, they remain accountable and should determine that any delegated tasks have been correctly performed.

Each  security  area  for  which  individuals  are  responsible  should  be  defined,  documented  and communicated. Authorization levels should be defined and documented. Individuals who take on a specific information security role should be competent in the knowledge and skills required by the role and should be supported to keep up to date with developments related to the role and required in order to fulfil the responsibilities of the role.

### Other information
Many organizations appoint an information security manager to take overall responsibility for the development and implementation of information security and to support the identification of risks and mitigating controls.

However, responsibility for resourcing and implementing the controls often remains with individual managers. One common practice is to appoint an owner for each asset who then becomes responsible for its day-to-day protection.

Depending on the size and resourcing of an organization, information security can be covered by dedicated roles or duties carried out in addition to existing roles.