Assign security roles and duties

What to do

1. 1

   Assign duties and decision authority

   Review existing security duties: for example protection of information and assets, risk treatment, acceptance of residual risks, rule upkeep and incident handling. For each duty, record the responsible role, necessary decision authority and an accessible assignment to a competent person. Add site or service detail only where needed. Use the existing role description; a responsible person remains accountable for the result when execution is delegated and checks that it was performed. Explicitly assign who ensures that the ISMS conforms to its requirements and reports ISMS performance to top management. Communicate roles and authorities to those involved.

2. 2

   Separate conflicting duties in the process

   Identify actual conflicts, such as requesting and approving your own rights or creating and approving a payment. Separate these duties in ownership and actual system permissions; include combined roles and possible collusion. Apply segregation as far as practicable. Where this remains difficult, decide suitable additional controls, such as independent management supervision, monitored activity or reviewable records, and check their actual application.

3. 3

   Enable role holders and the team to do the work

   Clarify competence, required development, cover, time and resources with the responsible managers. Before granting relevant access, explain duties and applicable security rules to the people concerned. Require their application and address obstacles through existing work planning. Provide suitable confidential reporting routes where practicable. Reuse briefing evidence instead of creating another document per person. Top management aligns the policy and objectives with strategic direction, integrates ISMS requirements into business processes and supports responsible people in effective implementation and continual improvement. It communicates why effective information security and meeting ISMS requirements matter and checks whether intended outcomes are achieved. It supports other managers in exercising security responsibility in their areas.

4. 4

   Check application and maintain changes

   Check an actual approval or security case: is it clear who executes, decides and checks, and are the necessary resources available? Address deviations through the existing case. Update roles, authority and cover at the leading location when duties or personnel change materially, and communicate changes to those concerned.

Worked example

A small IT team needs controlled approvals

Fictional example: one person performs technical administration and requests additional rights for their own work.

Record the result

• Leading role section with duties, accountability, authority and suitable cover.
• Separation implemented in the actual process or suitable additional controls.
• Existing briefing and work planning with necessary prerequisites resolved and application checked.

Reuse the implementation across requirements

The references below show which requirements the measure contributes to.

Templates for your implementation

• 

  Template

  Use the organisational section in the ISMS handbook

  Reuse your existing scope, policy and registers. The handbook connects management processes and identifies the decisions and evidence your organisation supplies.

  Free ZIP · DOCX, ODT and PDF · with editing instructions

  Request template
• 

  Template

  Explain applicable working rules

  An employee information security policy for using devices, information and accounts securely. Ready to adapt to your organisation.

  Free ZIP · DOCX, ODT and PDF · with editing instructions

  Request template
• 

  Template

  Define rights in the existing concept

  Adapt identity management, approvals and access reviews to your organisation. If you already maintain a suitable role model, link to it from the concept.

  Free ZIP · DOCX, ODT, PDF and XLSX · with editing instructions

  Request template