Key takeaways
- Make it clear who is responsible for which security tasks.
- Security fails quietly when nobody owns it.
- Start here: list the security activities you run (risk, access reviews, incident response, supplier checks).
Purpose
Make it clear who is responsible for which security tasks.
Requirement
Requirement summaryInformation security roles and responsibilities shall be defined and allocated according to the organization needs.
Why it matters
Security fails quietly when nobody owns it. Clear roles mean tasks get done, decisions get made and accountability is visible.
How to implement
- List the security activities you run (risk, access reviews, incident response, supplier checks).
- Assign an owner to each activity and capture it in a RACI or roles document.
- Reflect security duties in job descriptions for key roles.
- Communicate roles to the people concerned and refresh the list when people change jobs.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 5.2. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- A document listing the security roles in your organization and what each person is responsible for.
- Job descriptions for key roles that mention their security duties.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.5.2 marked as used or not used, a short reason, and its current status.
Records and examples to show
- An up-to-date organization chart showing who holds each security role.
- Proof people accepted their roles, such as an appointment email or meeting notes.
Things you should be able to show or explain
- Each person in a security role should be able to explain what they are responsible for.
How much to show: Check that every key role has a current, named person.
Common mistakes
- Roles still assigned to people who have left.
- Duties written in a policy but not in anyone's job description.
- Assigning everything to one security person with no deputies.
- Roles documented but the named people do not know they hold them.
- Tip: A simple RACI table beats long job descriptions.
Policies & documents to have
- Information Security Roles and Responsibility Policy
- ISMS roles, responsibilities and authorities document
- Risk Management Policy
FAQ
Is A.5.2 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.5.2?
Be ready to explain how the control works in your organisation and to provide things like: A document listing the security roles in your organization and what each person is responsible for…