Good security depends on people knowing who does what. The organization of information security covers exactly that: roles and responsibilities, separation of conflicting duties, contacts with authorities, security in projects, remote working and mobile devices.
In ISO 27001:2013, these topics sat together in Annex A.6. The 2022 edition spread them across several controls. This guide explains where each one now sits and how to implement it.
Free tool: How ready is your organization? Take our ISO 27001 self-assessment: 30 questions on clauses 4–10 and Annex A.
Mapping: A.6 (2013) to ISO 27001:2022
| ISO 27001:2013 | ISO 27001:2022 |
|---|---|
| A.6.1.1 Information security roles and responsibilities | 5.2 Information security roles and responsibilities |
| A.6.1.2 Segregation of duties | 5.3 Segregation of duties |
| A.6.1.3 Contact with authorities | 5.5 Contact with authorities |
| A.6.1.4 Contact with special interest groups | 5.6 Contact with special interest groups |
| A.6.1.5 Information security in project management | 5.8 Information security in project management |
| A.6.2.1 Mobile device policy | 8.1 User endpoint devices |
| A.6.2.2 Teleworking | 6.7 Remote working |
5.2 Information security roles and responsibilities
First, define who is responsible for what. Typical roles include:
- Top management: approves the policy, sets risk appetite and provides resources.
- ISMS manager or CISO: runs the programme day to day.
- Asset and risk owners: accept risks and approve controls for their areas.
- IT and security teams: operate technical controls.
- All staff: follow policies and report incidents.
Write these down in a RACI chart or role descriptions. Then make sure people actually know their responsibilities. Auditors often ask a risk owner to explain what they own.
5.3 Segregation of duties
Next, split conflicting tasks between different people. As a result, one person cannot commit and hide fraud or a serious mistake alone. Common examples:
- The person who requests access should not approve it.
- A developer should not deploy their own code to production without review.
- The person who processes payments should not reconcile the bank account.
Small companies cannot always separate duties. In that case, use compensating controls, such as management review of logs or dual approval for high-risk actions.
5.5 and 5.6 Contacts with authorities and interest groups
Keep an up-to-date list of authorities you may need to contact. In India, for example, this includes CERT-In for cyber incidents, the police cyber cell and sector regulators such as RBI or SEBI. Also include the Data Protection Board once the DPDP Act’s breach duties apply to you.
Similarly, join special interest groups. Industry forums, vendor security mailing lists and ISACs help you learn about threats early. These contacts also support the new 2022 control 5.7 on threat intelligence.
5.8 Information security in project management
Every project, not just IT projects, should consider security from the start. In practice:
- add a security checkpoint to project gates;
- assess risks when the project starts;
- include security requirements in project plans and budgets;
- review security again before go-live.
This is far cheaper than fixing problems after launch. In 2022, the control also absorbed A.14.1.1 on security requirements for new systems.
6.7 Remote working
Remote and hybrid work is now normal, so this control matters more than ever. A remote working policy should cover:
- approved devices and networks;
- VPN or zero-trust access to internal systems;
- multi-factor authentication;
- physical security at home, such as screen privacy and locking devices;
- rules for printing and storing paper documents;
- reporting lost devices immediately.
8.1 User endpoint devices
The 2013 mobile device policy became a broader control in 2022. It covers laptops, phones and tablets, whether company-owned or personal (BYOD). Key measures include:
- device registration and an inventory;
- full-disk encryption;
- screen lock and strong authentication;
- mobile device management (MDM) with remote wipe;
- timely patching and endpoint protection;
- clear rules for using personal devices for work.
What auditors check
For this area, auditors usually ask for:
- an organization chart and documented security roles;
- evidence that duties are segregated, or that compensating controls exist;
- a current contact list for authorities, with incident escalation steps;
- project templates that include security checkpoints;
- remote working and endpoint policies, plus MDM reports or encryption status.
FAQ
Do we need a full-time CISO for ISO 27001?
No. The standard requires clear responsibilities, not a specific job title. Many small firms assign the ISMS role to an IT manager, or use an external consultant.
Is BYOD allowed under ISO 27001?
Yes. However, you must manage the risk, for example with MDM, separate work profiles and clear rules.
Related guides
- ISO 27001:2022 Annex A: all 93 controls and the 2013 mapping
- Free ISO 27001:2022 readiness checklist
- What is an ISMS? Concept, benefits and the PDCA cycle
Sources
- ISO/IEC 27001:2022, Information security management systems (ISO)
- ISO/IEC 27002:2022, Information security controls (ISO)
Preparing for an ISO 27001 or IT audit? Our ISO 27001 readiness assessment finds your gaps before the auditor does. Doing it yourself? The ISO 27001:2022 Starter Kit (₹1,999) gives you the gap workbook, risk register, Statement of Applicability and 13 policy templates. You can also start with our free ISO 27001:2022 readiness checklist, or contact us for a quote.
