ISO 27002:2022, Control 5.2 – Information Security Roles and Responsibilities

Attributes Table

An attributes section is now included in the latest version of ISO 27002. Defining attributes is a way to classify controls. These allow you to easily match your control selection with typical industry terminology. The attributes for control 5.2 are:

What Is The Purpose of Control 5.2?

The purpose of control 5.2 is to establish a defined, approved and understood structure for the implementation, operation and management of information security within the organisation. This is a formal organisational structure that assigns responsibility for information security throughout the organisation.

Control 5.2 Explained

Control 5.2 addresses the implementation, operation and management of roles and responsibilities for information security in an organisation according to the framework as defined by ISO 27001.

The control states that information security roles and responsibilities should be well defined and that everyone involved should understand their role. Typically, assets are assigned a designated owner who assumes responsibility for their day-to-day care.

However, depending on the size of the organisation and the available resources, information security can be handled by a dedicated team or additional responsibilities assigned to current employees.

What Is Involved and How To Meet The Requirements

Allocating roles and responsibilities for information security is crucial for ensuring that the organisation’s information security is maintained and enhanced. To meet the requirements for this control, the allocation of roles should be formalised and documented, e.g., in a table form or in the form of an organisational chart.

• The organisation should define the responsibilities and accountabilities for information security within the organisation and assign them to specific management job functions or roles.
• This control should ensure that there is clarity with regard to the various roles and responsibilities within the organisation, in order to ensure that appropriate management attention is paid to information security.
• Where appropriate, further training for individual sites and information processing facilities should be provided to help fulfil these duties.

The intent here is to ensure that clear roles, responsibilities and authorities are assigned and understood throughout the organisation. In order to ensure effective segregation of duties, the roles and responsibilities should be documented, communicated and applied consistently across the organisation.

Differences Between ISO 27002:2013 and 27002:2022

As already pointed out, control 5.2 in ISO 27002:2022, Information Security Roles and Responsibilities, is not a new control. This is simply a modified control found in ISO 27002:2013 as control 6.1.1.

The purpose of Control 5.2 has been defined, and new implementation instructions have been included in the most recent revision of ISO 27002. While the essence of the two controls are basically the same, there are slight improvements in the 2022 version.

For example, ISO 27002:2022 states that Individuals who assume a specific information security function should be competent in the knowledge and skills required by the role and supported to remain up to speed with advances linked to the role and necessary to fulfil the obligations of the role. This point is not a part of the 2013 version.

Additionally, the implementation guidelines of both versions are slightly different. Let us compare sections of the two below:

ISO 27002:2013 states the areas for which individuals are responsible should be stated. These areas are:

a) the assets and information security processes should be identified and defined;

b) the entity responsible for each asset or information security process should be assigned and the details of this responsibility should be documented;

c) authorisation levels should be defined and documented;

d) to be able to fulfil responsibilities in the information security area the appointed individuals should be competent in the area and be given opportunities to keep up to date with developments;

e) coordination and oversight of information security aspects of supplier relationships should be identified and documented.

ISO 27002:2022 is more condensed. It simply states that the organisation should define and manage responsibilities for:

a) protection of information and other associated assets;

b) carrying out specific information security processes;

c) information security risk management activities and in particular acceptance of residual risks (e.g. to risk owners);

d) all personnel using an organisation’s information and other associated assets.

Both control versions however suggest that organisations can appoint an information security manager to take overall responsibility for the development and implementation of information security and to support the identification of controls.

Who Is In Charge Of This Process?

An information security manager is often appointed by companies to oversee the creation and execution of security measures and to aid in the detection of potential threats and controls.

Resourcing and putting the controls in place will typically fall to individual managers. A frequent practice is to designate an individual for each asset, who is then in charge of the asset’s ongoing security.

How ISMS.online Helps

You are not expected to do much in terms of meeting the requirements for the new ISO 27002:2022 standard except upgrading your ISMS processes to reflect the improved controls, if your in-house team cannot handle this, ISMS.online can help.

In addition to providing a sophisticated cloud-based framework for documenting ISMS procedures and checklists to assure compliance with established norms, ISMS.online also streamlines the ISO 27001 certification process and the ISO 27002 implementation process.

All of your ISMS solutions can be managed in a centralised location thanks to our cloud-based software. You can use our easy-to-use application to keep track of anything that is required to verify conformity with ISO 2K7 specifications.

Implementing ISO 27002 is simplified with our intuitive step-by-step workflow and tools that include frameworks, policies and controls, actionable documentation and guidance. You can define the scope of the ISMS, identify risks, and implement controls using our platform – in just a few clicks.

We also have an in-house team of information technology specialists that will provide you with advice and assistance so that you can demonstrate compliance to standard and dedication to information security to your customers.

In order to learn more about how ISMS.online can assist you in achieving your ISO 2K7 objectives, please call us at +44 (0)1273 041140.

Get in touch today to book a demo.