Information security roles and responsibilities

frameworkISO/IEC 27001:2022 sectionA.5 Organizational controls csf 2.0GV.RR-02 GV.SC-02 PR.AT-02 topicsRoles & Responsibilities frameworks5 4 2

Official text · not licensableTitle: Information security roles and responsibilities. The control text is ISO's copyright; see ISO/IEC 27001:2022.

gap from ISO 27001 → gap to ISO 27001 →

Wrong or missing mapping? Report it

Equivalents of A.5.2 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	GV.RR-01 GV.RR-02 GV.RR-03	Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving; Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced…	Crosswalk	Same topic: Roles & Responsibilities 2 loosely related (not mappings) GV.SC-02 Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally Loosely related Only shares CSF GV.SC-02: related, not a mapping PR.AT-02 Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind Loosely related Only shares CSF PR.AT-02: related, not a mapping
CIS v8.1	CIS 14.9 CIS 15.4 CIS 14.2 CIS 14.3	Conduct Role-Specific Security Awareness and Skills Training; Ensure Service Provider Contracts Include Security Requirements…	Loosely related	No mapping. Only shares CSF GV.RR-02, PR.AT-02, GV.SC-02: related, not a mapping +5 more loosely related (not mappings) CIS 14.4 Train Workforce on Data Handling Best Practices Loosely related Only shares CSF PR.AT-02: related, not a mapping CIS 14.5 Train Workforce Members on Causes of Unintentional Data Exposure Loosely related Only shares CSF PR.AT-02: related, not a mapping CIS 14.6 Train Workforce Members on Recognizing and Reporting Security Incidents Loosely related Only shares CSF PR.AT-02: related, not a mapping CIS 14.7 Train Workforce on How to Identify and Report if Their Enterprise Assets are Missing Security Updates Loosely related Only shares CSF PR.AT-02: related, not a mapping …and 1 more in the downloads
SOC 2	CC1.2 CC1.3 CC1.5	Board independence and oversight of internal control; Structures, reporting lines, authorities and responsibilities…	Editorial	Same topic: Roles & Responsibilities (editorial pick) 2 loosely related (not mappings) CC1.4 Commitment to attracting, developing and retaining competent people Loosely related Only shares CSF PR.AT-02: related, not a mapping CC2.2 Internal communication of objectives and responsibilities Loosely related Only shares CSF PR.AT-02: related, not a mapping
PCI DSS	12.1.3 12.1.4	Security roles and responsibilities defined; Executive responsibility for information security assigned	Crosswalk	Same topic: Roles & Responsibilities 17 loosely related (not mappings) 1.1.2 Roles for network security controls assigned Loosely related Only shares CSF GV.RR-02: related, not a mapping 2.1.2 Roles for secure configuration assigned Loosely related Only shares CSF GV.RR-02: related, not a mapping 3.1.2 Roles for protecting stored account data assigned Loosely related Only shares CSF GV.RR-02: related, not a mapping 4.1.2 Roles for protecting data in transit assigned Loosely related Only shares CSF GV.RR-02: related, not a mapping 5.1.2 Roles for malware protection assigned Loosely related Only shares CSF GV.RR-02: related, not a mapping 6.1.2 Roles for secure systems and software assigned Loosely related Only shares CSF GV.RR-02: related, not a mapping 6.2.2 Developers trained in secure software development Loosely related Only shares CSF PR.AT-02: related, not a mapping 7.1.2 Roles for access restriction assigned Loosely related Only shares CSF GV.RR-02: related, not a mapping …and 9 more in the downloads
CMMC	AT.L2-3.2.2	Role-Based Training	Loosely related	No mapping. Only shares CSF PR.AT-02: related, not a mapping
800-53	PM-2 PM-29 PS-9 AC-1 AT-1 AU-1 CA-1 CM-1 CM-9 CP-1 CP-2 IA-1 IR-1 MA-1 MP-1 PE-1 PL-1 PM-1 PM-10 PS-1 PS-7 RA-1 SA-1 SA-3 SA-9 SC-1 SI-1 SR-1	Information Security Program Leadership Role; Risk Management Program Leadership Roles…	Crosswalk	Same topic: Roles & Responsibilities NIST SP 800-53 → ISO 27001 mapping 8 loosely related (not mappings) AT-3 Role-based Training Loosely related Only shares CSF PR.AT-02: related, not a mapping PM-13 Security and Privacy Workforce Loosely related Only shares CSF GV.RR-02: related, not a mapping PM-19 Privacy Program Leadership Role Loosely related Only shares CSF GV.RR-02: related, not a mapping PM-23 Data Governance Body Loosely related Only shares CSF GV.RR-02: related, not a mapping PM-24 Data Integrity Board Loosely related Only shares CSF GV.RR-02: related, not a mapping SR-2 Supply Chain Risk Management Plan Loosely related Only shares CSF GV.SC-02: related, not a mapping SR-3 Supply Chain Controls and Processes Loosely related Only shares CSF GV.SC-02: related, not a mapping SR-5 Acquisition Strategies, Tools, and Methods Loosely related Only shares CSF GV.SC-02: related, not a mapping
HIPAA	§164.308(a)(2)	Assigned Security Responsibility	Crosswalk	Same topic: Roles & Responsibilities 5 loosely related (not mappings) §164.308(a)(5) Security Awareness and Training Loosely related Only shares CSF PR.AT-02: related, not a mapping §164.308(a)(5)(ii)(A) Security Reminders Loosely related Only shares CSF PR.AT-02: related, not a mapping §164.308(a)(5)(ii)(B) Protection from Malicious Software Loosely related Only shares CSF PR.AT-02: related, not a mapping §164.308(a)(5)(ii)(C) Log-in Monitoring Loosely related Only shares CSF PR.AT-02: related, not a mapping §164.308(a)(5)(ii)(D) Password Management Loosely related Only shares CSF PR.AT-02: related, not a mapping
GDPR	Art.37(1)Art.39(1)	Designation of the data protection officer; Tasks of the data protection officer	Editorial	Same topic: Roles & Responsibilities (editorial pick) 1 loosely related (not mappings) Art.39(1)(b) Tasks of the data protection officer Loosely related Only shares CSF PR.AT-02: related, not a mapping
NIS2	1.2	Roles, responsibilities and authorities	Crosswalk	Same topic: Roles & Responsibilities 3 loosely related (not mappings) 1.1 Policy on the security of network and information systems Loosely related Only shares CSF PR.AT-02: related, not a mapping 8.1 Awareness raising and basic cyber hygiene practices Loosely related Only shares CSF PR.AT-02: related, not a mapping 10.1 Human resources security Loosely related Only shares CSF PR.AT-02: related, not a mapping
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	Art.5(2)(c)Art.5(3)Art.6(4)	Governance and organisation; Governance and organisation…	Editorial	Same topic: Roles & Responsibilities (editorial pick) 2 loosely related (not mappings) Art.5(4) Governance and organisation Loosely related Only shares CSF PR.AT-02: related, not a mapping Art.13(6) Learning and evolving Loosely related Only shares CSF PR.AT-02: related, not a mapping
CPS 234	Para 13 Para 14	Board ultimately responsible for information security; Define information security roles and responsibilities	Editorial	Same topic: Roles & Responsibilities (editorial pick)
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.