ISO27001 RASCI Matrix

The RASCI table associates rôles in the organization with the sections of ISO/IEC 27001.
The roles are identified as R, A, S, C or I meaning:
Responsible i.e. this rôle has primary responsibility for performing the activities in this section.
Accountable i.e. this rôle will be called to account if the risks materialize (usually because preventive controls fail): i
Supportive i.e. this rôle actively assists with the design, implementation or management of the activities in this secti
Consulted i.e. this is a hands-off rôle, offering guidance and direction to those more actively involved.
Informed i.e. this rôle has an interest in the status of the risks in this section and should be kept in touch with the si
 rs
ne
w
tO
se

ag
As

an
m
Em tion

O es

ve
Section of ISO/IEC 27001:2013

CE ye
a

uti
rm

o
pl

ec
fo
R = Responsible A = Accountable S = Supportive C = Consulted I = Informed

Ex
In
5 Information security policies
5.1.1 Policies for information security C I C
5.1.2 Review of the policies for information security C S

6 Organizing information security

6.1.1 Information security roles and responsibilities A I
6.1.2 Segregation of duties A I
6.1.3 Contact with authorities A
6.1.4 Contact with special interest groups A
6.1.5 Information security in project management A
6.2.1 Mobile device policy A I
6.2.2 Teleworking A I

7 Human resource security

7.1.1 Screening A
7.1.2 Terms and conditions of employment A I
7.2.1 Management responsibilities A I
7.2.2 Information security awareness, education, and training A I
7.2.3 Disciplinary process A I
7.3.1 Termination or change of employment responsibilities A I

8 Asset management
8.1.1 Inventory of assets A
8.1.2 Ownership of assets A
8.1.3 Acceptable use of assets A I
8.1.4 Return of assets A I
8.2.1 Classification of information A I
8.2.2 Labelling of information A I
8.2.3 Handling of assets A I
8.3.1 Management of removable media A I
8.3.2 Disposal of media A I
8.3.3 Physical media transfer A I
9 Access control
9.1.1 Access control policy A
9.1.2 Policy on the use of network services A I
9.2.1 User registration and de-registration A
9.2.2 User access provisioning A
9.2.3 Privilege management A
9.2.4 Management of secret authentication information of users A
9.2.5 Review of user access rights A
9.2.6 Removal or adjustment of access rights A
9.3.1 Use of secret authentication information A I
9.4.1 Information access restriction A I
9.4.2 Secure log-on procedures A
9.4.3 Password management system A
9.4.4 Use of privileged utility programs A I
9.4.5 Access control to program source code A I

10 Cryptography
10.1.1 Policy on the use of cryptographic controls A I
10.1.2 Key management A

11 Physical and environmental security

11.1.1 Physical security perimeter A I
11.1.2 Physical entry controls A I
11.1.3 Securing offices, rooms and facilities A I
11.1.4 Protecting against external and environmental threats A I
11.1.5 Working in secure areas A I
11.1.6 Delivery and loading areas A I
11.2.1 Equipment siting and protection A I
11.2.2 Supporting utilities A
11.2.3 Cabling security A
11.2.4 Equipment maintenance A
11.2.5 Removal of assets A I
11.2.6 Security of equipment and assets off-premises A I
11.2.7 Secure disposal or re-use of equipment A I
11.2.8 Unattended user equipment A I
11.2.9 Clear desk and clear screen policy A I

12 Operations security
12.1.1 Documented operating procedures A
12.1.2 Change management A I
12.1.3 Capacity management A
12.1.4 Separation of development, test and operational environments A
12.2.1 Controls against malware A
12.3.1 Information backup A
 12.4.1 Event logging A
12.4.2 Protection of log information A
12.4.3 Administrator and operator logs A
12.4.4 Clock synchronization A
12.5.1 Installation of software on operational systems A I
12.6.1 Management of technical vulnerabilities A
12.6.2 Restrictions on software installation A I
12.7.1 Information systems audit controls A

13 Communications security
13.1.1 Network controls A
13.1.2 Security of network services A
13.1.3 Segregation in networks A
13.2.1 Information transfer policies and procedures A I
13.2.2 Agreements on information transfer A
13.2.3 Electronic messaging A I
13.2.4 Confidentiality or non-disclosure agreements A

14 System acquisition, development and maintenance

14.1.1 Security requirements analysis and specification A
14.1.2 Securing application services on public networks A
14.1.3 Protecting application services transactions A
14.2.1 Secure development policy A
14.2.2 Change control procedures A
14.2.3 Technical review of applications after operating platform changes A
14.2.4 Restrictions on changes to software packages A
14.2.5 System development procedures A
14.2.6 Secure development environment A
14.2.7 Outsourced development A
14.2.8 System security testing A
14.2.9 System acceptance testing A C
14.3.1 Protection of test data A

15 Supplier relationships
15.1.1 Information security policy for supplier relationships A
15.1.2 Addressing security within supplier agreements A
15.1.3 Information and communication technology supply chain A
15.2.1 Monitoring and review of supplier services A
15.2.2 Managing changes to supplier services A

16 Information security incident management

16.1.1 Responsibilities and procedures A
16.1.2 Reporting information security events A I
16.1.3 Reporting information security weaknesses A I
16.1.4 Assessment of and decision on information security events A
 16.1.5 Response to information security incidents A
16.1.6 Learning from information security incidents A
16.1.7 Collection of evidence A

17 Information security aspects of business continuity management

17.1.1 Planning information security continuity A
17.1.2 Implementing information security continuity A
17.1.3 Verify, review, and evaluate information security continuity A
17.2.1 Availability of information processing facilities A

18 Compliance
18.1.1 Identification of applicable legislation and contractual requirements A I R
18.1.2 Intellectual property rights (IPR) A I C
18.1.3 Protection of records A I R
18.1.4 Privacy and protection of personal information A I C
18.1.5 Regulation of cryptographic controls A
18.2.1 Independent review of information security A
18.2.2 Compliance with security policies and standards A I
18.2.3 Technical compliance inspection A

Number of responsibilities 0 0 2
Number of accountabilities 112 0 0
Number of controls supported 0 0 1
Number of controls on which consulted 2 1 3
Number of controls of which informed 0 48 0
 S
S
S
C
C
C
C
C

R
R
R
R
R
A
A
Ex
ec
u

S
S
S
S
S
S
S
S
S
S
S
S
S
S

C
C
C

R
R
R
R
R
R
R
IS tive
M
S m

S
S
S
S
S
S
S

C
C
C
C
C

R
R
R
In Ste ana
fo er ge
rm in m

C
C
C
C
C
C
Op ati g C en
er on om t
a

S
S
S
S
S
S
S

R
R

C
C
C
He tio Sec mitt
ad ns ur ee
S i

S
S
S
S
S
S
C
C
Pr of H ecu ty M
oc
u R r ity an

S
S
S
S
S
S
S

C
C
C
C
C
C

R
R
R
R
He rem Te age
ad en am r
He of I t
ad T/
o f C IO
XX
S R S S C S
S C S R
S C R S
S C R S
S R
S C C R
C S R S C S
S S C R
S S R
S C R
S C R
S C S R
S C S R
S C S R

S R S
S R S

S C R C
S C R C
S C R C
S C R C
S C R
S C R
S C R
S C R C
S C S R
S C R
S C R
S C C R
S C S R
S C S R
S C S R

C S R
S R S S
S R C S
S R C S S
S C S R
R S C S
S S C S R
S S R C S
S R S S
C S R
S C R
S S S R
S S S R
S S R S S

S C S R
S C R
S C R
S R S
S R S S
S S C R
S S S S S

C S R C
C R S S S
S C S R
C S S S
C S R S
S R S
S S S R
R S S
S S S
S S C S
S R S S
S S S
R S S S

C R S
S R S
S R S
S C R
S S R

R S S S S
S R S S S
S R S S S
R S S S S
 S R S S S
R S C C C C
R S S S

S R S S
S S R S S
R S S S
S S S R S

S S S S S
R S S S
S S S S
S S S
R S
R S C
S R S
S R S

8 22 23 0 4 11 34 0
2 0 0 0 0 0 0 0
21 82 32 29 9 20 52 0
11 3 41 12 6 5 14 0
0 0 0 0 0 0 0 0