[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-5-2":3},{"item":4,"lessons":16,"controls":18,"related":19},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-5-2","Annex A 5.2","Information security roles and responsibilities",0,"International Organization for Standardization (ISO) and IEC","**What it asks for.** Information security roles and responsibilities should be defined and allocated according to the organisation's needs. Everyone should know what they are accountable for.\n\n**In practice.** The organisation documents who owns the management system, who owns information and assets, who owns risks, and who performs specific security activities such as access reviews or incident handling. Responsibilities are written into job descriptions or a RACI and communicated. Where duties are outsourced, accountability remains clearly with a named internal role. Evidence includes role descriptions, a responsibility matrix, asset and risk owner assignments and appointment records.\n\n**Common gaps.** Asset and risk ownership is often assigned to IT by default rather than to the business owner who can make decisions. Roles go unfilled after reorganisations without anyone noticing.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[],[],[]]