Information security and cybersecurity roles, responsibilities and authorities within the organization shall be documented, reviewed, authorized, and updated and alignment with organization-internal roles and external partners.
Guidance
It should be considered to:
- Describe security roles, responsibilities, and authorities: who in your organization should be
consulted, informed, and held accountable for all or part of your assets.
- Provide security roles, responsibilities, and authority for all key functions in information/cyber
security (legal, detection activities…).
- Include information/cybersecurity roles and responsibilities for third-party providers with physical or logical access to the organization’s ICT/OT environment.
The organization shall appoint an information security officer.
Guidance
The information security officer should be responsible for monitoring the implementation of the organization's information/cyber security strategy and safeguards.
Top management must ensure clear responsibilities / authority on at least the following themes:
The ISMS theme owners are presented on the desktop of the management system and in the Information security policy report.
In addition, top management shall ensure that all roles relevant to information security, as well as related responsibilities and authorities, are defined and communicated. It is also important to recognize the roles and responsibilities of external partners and providers.
Kun organisaatio käyttää pilvipohjaista tietojärjestelmää, organisaation tulee ymmärtää ja vahvistaa siihen liittyvät tietoturvaroolit ja -vastuut palvelusopimuksen mukaisesti.
Näihin voi kuulua esimerkiksi seuraaviin vastuisiin liittyviä tehtäviä:
Paranna osaamistasi viikoittaisten webinaarien, videokurssien, artikkeleiden ja blogien avulla.
