Key takeaways
- Assign and communicate who is responsible for the ISMS and for reporting on its performance.
- People need to know who is responsible for the ISMS and who reports on its performance.
- Start here: assign responsibility for ensuring the ISMS meets the standard.
Purpose
Assign and communicate who is responsible for the ISMS and for reporting on its performance.
Requirement
Requirement summaryTop management shall ensure that the responsibilities and authorities for roles relevant to information security are assigned and communicated within the organization. Top management shall assign the responsibility and authority for: a) ensuring that the information security management system conforms to the requirements of this document; b) reporting on the performance of the information security management system to top management. NOTE Top management can also assign responsibilities and authorities for reporting performance of the information security management system within the organization.
Why it matters
People need to know who is responsible for the ISMS and who reports on its performance.
How to implement
- Assign responsibility for ensuring the ISMS meets the standard.
- Assign responsibility for reporting ISMS performance to top management.
- Document and communicate roles and authorities.
- Update when the organisation changes.
What evidence you need to provide
Here is what you will typically need to provide for Clause 5.3. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- A document listing security roles and responsibilities, including who runs the programme and who reports to top management.
Records and examples to show
- An organization chart with security roles filled.
- Appointment letters or meeting notes assigning roles.
Things you should be able to show or explain
- People in these roles should be able to explain their duties.
How much to show: All key roles.
Common mistakes
- Roles vacant or assigned to leavers.
- No one reporting to management.
- Roles assigned informally with no record.
- No one tasked with reporting to leadership.
- Tip: Get one senior sponsor who genuinely cares. It makes everything else easier.
Policies & documents to have
- ISMS roles, responsibilities and authorities document
FAQ
Can we exclude clause 5.3?
No. Clauses 4–10 are mandatory for certification; only Annex A controls can be excluded, with justification.
What do auditors look for?
Named owners who know their roles.