Policy – ISMS Roles and Responsibilities

Title	Policy – ISMS Roles and Responsibilities
Classification:	Internal Use Only
Reviewer (suitability and adequacy)	All Head of Departments/All Document Owners
Approver (suitability and adequacy)	Top Management
Document Owner	ISMS Manager/Head - HR
Modification History:
S. No.	Description of Change	Date of Change	Version No.
1	First release	XX|XX|20XX	1.0
2
3

Table of Contents

1.	Purpose	2

2.	Organization Chart	3

3.	Security Forum	4

4.	ISMS Role Description	5

5.	Top Management Responsibilities	5

6.	Security Forum	6

7.	ISMS Manager	7

8.	Head of Department (HOD)/Team as per Company structure	8

9.	End-Users/Employees and/or contractors	9

10.	Internal Auditors	10

11.	Procedure – New ISMS Role	11

12.	Additional Policy/Procedure/Records	11

13.	Policy Review	11

Annexure I – ISMS Nominations	12

Purpose

The purpose of this policy is to define roles and responsibilities for an effective and measurable Information Security Management System (ISMS).

The document explains key ISMS Roles that include top management, the forum, the ISMS Manager, individual control/risk owners, end users, and internal auditors.

Through this policy, the management is also defining segregation of duties to ensure successful security policy compliance.

Management may also seek external advice as and when needed.

Organization Chart

Security Forum

NOTE: A brief description of each of the roles is provided in the next section.

ISMS Role Description

Listed below are the teams/roles created by Company for the design, development, operation, audit and measurement of an effective Information Security Management System (ISMS). These teams shall operate ISMS as per the responsibilities listed (not exhaustive).

Top Management Responsibilities

Top management demonstrates leadership and commitment with respect to the information security management system by:

Ensuring the business objectives and risk objectives are aligned, established and are compatible with the strategic direction of Company;

Ensuring the integration of ISMS into Company’s processes;

Ensuring that the resources needed for the ISMS are available; Resources include information, human resources, skills, technology or policy changes;

Communicating the importance of effective ISMS and conforming to the ISMS requirements;

Ensuring that the ISMS achieves its intended outcome(s);

Directing and supporting persons to contribute to the effectiveness of ISMS;

Promoting continual improvement; and

Supporting other relevant management roles to demonstrate their leadership as it applies to their areas of responsibility.

Responsibility for conducting management reviews

Ensuring that the ISMS conforms to requirements and assigning reporting responsibilities in addition to those listed

Additional responsibilities on awareness and policies

Management is responsible for ensuring that personnel:

a) Are properly briefed on their information security roles and responsibilities before being granted access to Company’s information and other associated assets;

b) Are provided with guidelines, which state the information security expectations of their role within Company;

c) Are mandated to fulfil the information security policy and topic-specific policies of Company;

d) Achieve a level of awareness of information security relevant to their roles and responsibilities within Company;

e) Compliance with the terms and conditions of employment, contract or agreement, including Company’s information security policy and appropriate methods of working;

f) Continue to have the appropriate information security skills and qualifications through ongoing professional education;

g) Where practicable, are provided with a confidential channel for reporting violations of information security policy, topic-specific policies or procedures for information security (“whistleblowing”).

This can allow for anonymous reporting or have provisions to ensure that knowledge of the identity of the reporter is known only to those who need to deal with such reports.

h) Are provided with adequate resources and project planning time for implementing Company’s security-related processes and controls.

Authority

To take decisions on issues related to risk/resources

Key Skills & Competencies

Leads Company towards security risk management best practices

Communicates business objectives and risk whenever new issues arise

Training: Attendance to management reviews and/or audit sessions

Certification: No certification required, should lead’ the risk-related decisions

Security Forum

This is a team represented by all heads of departments in Company. When this team meets, they decide on issues that have a general impact across Company.

Key Skills & Competencies

Leads Company towards security risk management best practices

Communicates business objectives and risk whenever new issues arise

Training: Attendance at management reviews and/or audit sessions

Certification: Refer to the individual head of department section

ISMS Manager

Primary Responsibility

Responsible for the ISMS program, ensuring Company adheres to all ISMS/Security policies and procedures

Verifies and performs risk assessments for new products, projects, and customer acquisitions, with support from other functions.

Single point of contact for all matters related to ISMS/Security.

Maintains and updates an ISMS Risk register to track Company weaknesses and present to management for informed decision-making. Decisions requiring implementation are tracked with the implementation team till closure. Risks for which no action has been taken are reported to top management for residual risk approval.

Responsible for reporting on the full or part of the ISMS monthly.

Coordination Responsibility

Ensures policy objectives are met and is responsible for the supervision of records generated as per the security operation

Information Security budget preparation and submission to top management for approval

ISMS Annual program maintenance

Gives his/her opinion on issues involving disciplinary action related to information security

Escalates issues to the security forum/top management when needed

Authority

To create additional policy, procedure and metrics with respect to ISMS operation

Key Skills & Competencies

Understands business, compliance objectives and how Company plans to control

Understands ISO 27001 control requirements

Ability to interpret policy documents (internal and external) and explain to businesses how to implement or demonstrate compliance.

Training: Mandatory attendance at ISO 27001 clause interpretation sessions

Certifications: No additional certification requirements.

Head of Department (HOD)/Team as per Company structure

The head of department is responsible for ensuring the following security processes (not exhaustive):

Heads of departments are derived from ISMS nominations.

HOD documents and updates policies and processes that define the operations in the specific function.

Understands and owns security/compliance responsibility as distinct from operational/revenue-generating responsibilities.

Risk Owner: Each department head is the owner of the risks that are allocated to them. Risk Owner means someone accountable for the failure of the control. The Risk Owner is also responsible for reporting any weaknesses/issues that they identify to the top management or to the ISMS manager.

Encourages team members to report risks or incidents relevant to any part of Company.

First point of contact within the departments for incident/weakness reporting. If a user reports an incident/weakness/they can determine whether it should be escalated.

Managers are responsible for conducting a ‘self–assessment’ and reporting any deviations or risks to top management or the Risk Officer. This can be policy gaps, technology gaps, or any other resource requirement.

Ensures that any information processing work has segregation of duties well entrenched in the internal roles such that there is no opportunity for fraud, if applicable to the team or the process.

Authority

To inform management about any new risk/vulnerability

Key Skills & Competencies

Understand the business need for protection.

Understand the business’s impact' of violation

Access to the ISMS roles & responsibilities document

Training: Attendance at a security awareness session once a year. Participates in any control-specific discussion/exercise related to the area—Attends Management Reviews associated with Security.

Certification: No security certification required.

End-Users/Employees and/or contractors

End Users encompass all personnel in the scope of delivery of services.

End users comply with the end-user policy/procedure, namely Acceptable Usage Policy, which describes each user's behaviour with respect to information usage.

Reports risks/security weaknesses/incidents to either the head of department or the Risk officer.

Authority

To report any new weakness/incident to the head of department/Risk officer

Key Skills & Competencies

Awareness of enterprise policies and procedures

Training: Annual Attendance to the classroom awareness session

Certification: No security certification required

Internal Auditors

Functions upon the directives of the top management/Security forum and carries out regular review of ISMS, based on the defined scope.

The individuals nominated should be impartial, who have no material benefit in the outcome of the Internal audit, positive or negative.

Makes judgment on the effectiveness of the selected policies, procedures and records

Reports internal audit findings to the top management and recommends preventive and corrective action, and

Reviews the implementation of the audit findings

Authority

To raise conformity and non-conformity in any aspect of ISMS operation.

Key skills & Competencies

Ability to make judgments about the 'intent, implementation and effectiveness'.

Pass a judgment and make a justification of the judgment

Access to the ISMS roles & responsibilities document

Training: Mandatory attendance to ISO 27001 clause interpretation sessions

Certifications: preferred, but not mandatory – ISO 27001 Lead Auditor, ISO 27001 Internal Auditor, ISO 27001 Implementation Training

Procedure – New ISMS Role

The purpose of this procedure is to have a smooth transition for those roles that have ISMS/ISO 27001 responsibilities.

This procedure is only applicable for top management, the ISMS manager, the head of department and the internal auditor.

Whenever a new person joins, who will take up any of the ISMS, HR will inform the ISMS manager. In case ISMS manager is replaced, then the head of HR will perform this role.

ISMS Manager will assess the role of the individual and call for a one-to-one session to explain the role and associated responsibilities.

The role will acknowledge on email that he/she understood the allocated tasks, as a sign off for undertaking the new role.

Additional Policy/Procedure/Records

ISMS Nomination - Every leader identified in the ISMS nomination should review their scope of ISMS and advise changes through an annual self-assessment/declaration at least annually

Policy Review

The policy is reviewed annually and/or when significant changes occur.

Annexure I – ISMS Nominations

SN	Control Area*	Head of Department	Second Nomination
1	Application Development
2	Internal IT/Cloud Support
3	Human Resources
4	Physical Security
5	Legal Compliance
6	Supplier Management/procurement
7	Business Development/Sales
8	Business Continuity
9	Project Management
10	Top Management/CEO/Organization Head/Board Member/s
11	ISMS Manager or CISO