1.2 Roles, responsibilities and authorities

Requirement

As part of their policy on the security of network and information systems referred to in point 1.1, the relevant entities shall lay down responsibilities and authorities for network and information system security and assign them to roles, allocate them according to the relevant entities’ needs and communicate them to the management bodies.

Guidance

• Write job descriptions in a way that clearly outlines rights and responsibilities.
• Assign security roles and responsibilities to personnel and include these roles in the organisational chart.
• Describe roles and assign corresponding responsibilities (e.g. chief information security officer), based on the guidance of international frameworks and standards, including the European cybersecurity skills framework (ECSF) (11).
• Ensure that the roles allocated are suitable for the size and business needs of the entity.
• Formally appoint competent personnel in security roles. Ensure that these assigned persons are competent on the basis of appropriate education, training or experience.

Examples of evidence

• Job descriptions.
• List of security roles, who occupies them and contact information.
• Formal appointment of the key security roles and responsibilities, for example, listed in the company organigram or management decision, etc.
• List of appointments and description of responsibilities and tasks for security roles.
• Evidence of competence of the assigned persons.

Requirement

The relevant entities shall require all personnel and third parties to apply network and information system security in accordance with the established network and information security policy, topic-specific policies and procedures of the relevant entities.

Guidance

• Make personnel aware of the security roles in the entity and when each role should be contacted.
• Make personnel aware of their network and information system security obligations, according to their role. For the disciplinary process, see point 10.4 in the Annex to the regulation.
• Make relevant interested external parties aware of their network and information system security obligations.
  • For contractual requirements of direct suppliers and service providers, see point 5.1.4 in the Annex to the regulation.
  • Consider third parties, which means external entities or organisations not directly involved in the operations of the entity in scope but that may still affect its network and information security. For examples of relevant interested external parties, consider the guidance in section 1.1.
• The requirement that all personnel and third parties apply network and information system security should be communicated in a form that is relevant, accessible and understandable to the intended reader.
  • The network and information security policy, topic-specific policies and procedures of the relevant entities do not necessarily need to be communicated in their entirety.

Examples of evidence

• Awareness/dissemination material for personnel, explaining security roles and when/how they should be contacted.
• Service level agreements (SLAs), contracting contracts, data-processing agreements or other types of contracts or agreements with third parties.
• Acknowledgement from third parties in various forms (letters, emails, portals or other online options) confirming that they have received and understand their obligations related to network and information system security, where such requirements are not covered by contractual arrangements.

Requirement

At least one person shall report directly to the management bodies on matters of network and information system security.

Guidance

• Appoint a person (e.g. chief information security officer or information security manager) responsible for overseeing network and information security matters.
• Make sure that this role is recognized and duly authorized by management bodies.

Examples of evidence

• Up-to-date documentation of the structure of security role assignments and responsibilities.
• Minutes from meetings with the management.
• Evidence of business decisions made (e.g. investments in cybersecurity).

Requirement

Depending on the size of the relevant entities, network and information system security shall be covered by dedicated roles or duties carried out in addition to existing roles.

Guidance

• It is often practical to have dedicated information security roles (e.g. a chief information security officer or security analysts) who focus solely on protecting the entity’s data and systems.
• In entities with limited resources, information security responsibilities may be distributed among existing roles. For instance, information technology (IT) staff might take on security duties alongside their regular tasks. However, the persons assigned should have relevant experience and training to perform the roles and to exercise their responsibilities.

Examples of evidence

• Verify the presence of dedicated security roles in larger entities.
• Check if security responsibilities are assigned to existing roles in smaller entities.

Requirement

Conflicting duties and conflicting areas of responsibility shall be segregated, where applicable.

Guidance

• Consider segregating conflicting duties and areas of responsibility to reduce opportunities for unauthorized or unintentional modification or misuse of the entity’s asset. As a minimum, consider that the reviewer (auditor) must be different from the personnel or the line of authority of the area under review.
• The results of the risk assessment or the business impact analysis (BIA) could be used to identify potential conflicting duties and areas of responsibility.

Examples of evidence

• Up-to-date documentation of the structure of security role assignments and responsibilities.

Requirement

Roles, responsibilities and authorities shall be reviewed and, where appropriate, updated by management bodies at planned intervals and when significant incidents or significant changes to operations or risks occur.

Guidance

• Regularly review and revise the structure of security roles and responsibilities, based on (indicative, non-exhaustive list):
  • significant incidents, if any;
  • changes to the environment of operation, including changes to the network and information systems;
  • organisational changes.
• Where appropriate, updates should be approved by management bodies.

Examples of evidence

• Up-to-date documentation of the structure of security role assignments and responsibilities, including version history.
• Documentation of the review process, taking into account changes and past incidents.

Tips: guidance

• Make sure that the roles responsible for security roles are contactable in case of incidents.
• Make sure that each role has its deputy or that measures ensuring continuity in the event of the role representative’s absence are in place, where possible.
• Establish a clear reporting line from the designated security officer to senior management.
• Ensure that security reporting is integrated into the entity’s overall risk management framework.

Tips: examples of evidence

• Documented incident response procedures (Annex to the regulation, point 3.5.1) including clear procedures for contacting security roles during an incident.
• Logs and records of past incidents to check if the security roles were contacted promptly and effectively.
• Crisis management process and incident response records to check the involvement of the management.
• Up-to-date organisational chart to check if it clearly shows the reporting structure, including the designated security officer and their direct line to senior management. The organisational chart should be dated and the person making the update should be noted.