Organizational roles, responsibilities and authorities

frameworkISO/IEC 27001:2022 sectionISMS clauses 4–10 csf 2.0GV.SC-02 topics— frameworks2 1 7

Official text · not licensableTitle: Organizational roles, responsibilities and authorities. The control text is ISO's copyright; see ISO/IEC 27001:2022.

gap from ISO 27001 → gap to ISO 27001 →

Wrong or missing mapping? Report it

Equivalents of Clause 5.3 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	GV.SC-02	Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally	Loosely related	No mapping. Only shares CSF GV.SC-02: related, not a mapping
CIS v8.1	CIS 15.4	Ensure Service Provider Contracts Include Security Requirements	Loosely related	No mapping. Only shares CSF GV.SC-02: related, not a mapping
SOC 2	CC1.3 CC1.5	Structures, reporting lines, authorities and responsibilities; Accountability for internal control responsibilities	Editorial	ControlMapping editorial: Both require defined structures, reporting lines, roles and authorities for security.; ControlMapping editorial: Holding people accountable for their security responsibilities: assigned responsibilities (5.3) and a disciplinary process (A.6.4).
PCI DSS	12.1.4 12.8.3 12.8.4 12.10.1	Executive responsibility for information security assigned; Due diligence before engaging service providers…	Loosely related	No mapping. Only shares CSF GV.SC-02: related, not a mapping
CMMC	—	No requirement	No mapping in our data	No mapping in our data.
800-53	AC-1 AT-1 AU-1 CA-1 CM-1 CP-1 IA-1 IR-1 MA-1 MP-1 PE-1 PL-1 PM-1 PM-2 PM-6 PM-29 PS-1 RA-1 SA-1 SC-1 SI-1 SR-1	Policy and Procedures; Policy and Procedures…	Crosswalk	NIST SP 800-53 → ISO 27001 mapping 3 loosely related (not mappings) SR-2 Supply Chain Risk Management Plan Loosely related Only shares CSF GV.SC-02: related, not a mapping SR-3 Supply Chain Controls and Processes Loosely related Only shares CSF GV.SC-02: related, not a mapping SR-5 Acquisition Strategies, Tools, and Methods Loosely related Only shares CSF GV.SC-02: related, not a mapping
HIPAA	—	No requirement	No mapping in our data	No mapping in our data.
GDPR	—	No requirement	No mapping in our data	No mapping in our data (only GDPR's security articles are mapped, editorially).
NIS2	1.2	Roles, responsibilities and authorities	Crosswalk	ENISA NIS2 → ISO 27001 mapping
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	—	No requirement	No mapping in our data	No mapping in our data (DORA links are editorial, and its technical standards are not mapped).
CPS 234	—	No requirement	No mapping in our data	No mapping in our data (CPS 234 is principles-based and its links are editorial).
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.