12 new national NIS2 framework versions published! Read more ->
Cyberday back to normal - related blog
Information security and cybersecurity roles, responsibilities and authorities within the organization shall be documented, reviewed, authorized, and updated and alignment with organization-internal roles and external partners.
Guidance
It should be considered to:
- Describe security roles, responsibilities, and authorities: who in your organization should be
consulted, informed, and held accountable for all or part of your assets.
- Provide security roles, responsibilities, and authority for all key functions in information/cyber
security (legal, detection activities…).
- Include information/cybersecurity roles and responsibilities for third-party providers with physical or logical access to the organization’s ICT/OT environment.
The organization shall appoint an information security officer.
Guidance
The information security officer should be responsible for monitoring the implementation of the organization's information/cyber security strategy and safeguards.
Top management must ensure clear responsibilities / authority on at least the following themes:
The ISMS theme owners are presented on the desktop of the management system and in the Information security policy report.
In addition, top management shall ensure that all roles relevant to information security, as well as related responsibilities and authorities, are defined and communicated. It is also important to recognize the roles and responsibilities of external partners and providers.
When an organisation is using a cloud-based data system, the organisation should understand and confirm the related information security roles and responsibilities as stated in the service agreement.
These can include responsibilities related e.g. to:
.png)
