Clause 5.3.b An employee or team should understand and manage the system, although every single employee is also responsible for information security.