5.2 Information security roles and responsibilities

Assign security positions and obligations according to policy. Identify and govern responsibilities for asset protection, security processes, risk management, and personnel. Provide detailed guidance where necessary. Those with assigned responsibilities may delegate tasks, but remain accountable. Define security areas and authorization levels, and ensure competence and ongoing training for those in security roles.