Top management shall ensure that responsibilities and authorities for roles relevant to information security are assigned and communicated within the organization.
In other words, leaders must define who is responsible and who has authority over key aspects of the Information Security Management System (ISMS), and communicate this clearly throughout the organization.
Elaborated guidance highlights that top management must ensure:
a. Assignment of responsibility and authority for ensuring the ISMS conforms to the standard’s requirements.
b. Assignment of responsibility and authority for reporting on ISMS performance to top management
