ISMS Roles & Responsibilities Template

Document Control

1. Executive Sponsor / Top Management

Assigned to: [Name/Title]

Responsibilities:

• Provide leadership and commitment to the ISMS
• Approve information security policy
• Allocate adequate resources
• Conduct management reviews
• Communicate importance of security

Authority:

• Final decision on risk acceptance
• Budget approval
• Policy approval

2. ISMS Manager / Information Security Officer

Assigned to: [Name/Title]

Responsibilities:

• Establish, implement, and maintain the ISMS
• Report on ISMS performance to top management
• Coordinate security activities across the organization
• Manage the risk assessment process
• Oversee incident management

Authority:

• Direct security-related activities
• Request resources for security initiatives
• Escalate issues to top management

3. Risk Owners

Assigned to: [Department Heads / Process Owners]

Responsibilities:

• Accept or escalate risks in their area
• Implement risk treatment plans
• Monitor control effectiveness
• Report on risk status

4. Asset Owners

Assigned to: [As per Asset Register]

Responsibilities:

• Classify assets appropriately
• Define access requirements
• Ensure asset protection measures
• Review asset controls periodically

5. Internal Auditor(s)

Assigned to: [Name/Title or External Provider]

Responsibilities:

• Plan and conduct internal audits
• Report audit findings
• Verify corrective actions
• Maintain auditor independence

6. All Employees

Responsibilities:

• Comply with security policies and procedures
• Report security incidents and weaknesses
• Complete security awareness training
• Protect information assets in their care

Approval

Next Lesson: Build your RACI Matrix for ISMS activities.