Iso27001 Rasci Table v3

8/11/2019 Iso27001 Rasci Table v3

1/13
http://www.iso27001security.com/


2/13

ISO27k RASCI tableOriginal German audit table generously contributed to the ISO27k Toolkit by Matthias Wagner (version 1,

April 2011)

Eventually translated to English, modified and this page added by Gary Hinson (version 2, October 2012)

The RASCI table associates rles in the organization with the sections of ISO/IEC 27002.

The roles are identified as R,A,S,CorI, meaning:

- Responsiblei.e. this rle has primary responsibility for performing the activities in this section

- Accountable i.e. this rle will be called to account if the risks materialize (usually because preventive

- Supportivei.e. this rle actively assists with the design, implementation or management of the activities

- Consultedi.e . this is a hands-off rle, offering guidance and direction to those more actively involved

- Informedi.e . this rle has an interest in the status of the risks in this section and should be kept in touch

Some organizations are prefer the simpler RACI, and that's fine: this is simply a tool to help figure out and

describe who does what in relation to the Information Security Management System. Use it as you wish.

The contents of the RASCI table in the ISO27k Toolkit merely demonstrate how we envisage the table

being used. It is a starting point, with many gaps and innacuracies. Customize the table as much as you

like. Do not feel in any way constrained by the examples provided - in fact it's probably best to delete

Notice that as you enter R/A/S/C/I, the cells are automatically colour coded for you using Excel's

Copyright

Commons Attribution-Noncommercial-Share Alike 3.0 License. You are welcome to reproduce, circulate,

use and create derivative works from this provided that (a) it is not sold or incorporated into a commercial

product, (b) it is properly attributed to the ISO27k Forum at www.ISO27001security.com, and (c) if they
http://www.iso27001security.com/http://creativecommons.org/licenses/by-nc-sa/3.0/http://www.iso27001security.com/


3/13


4/13


5/13


6/13

Info

r

5 Information security policies

Section of ISO/IEC 27002:2013R = Responsible A = Accountable S = Supportive C = Consulted I = Informed

5.1.1 Policies for information security C I

5.1.2 Review of the policies for information security C

6.1.1 Information security roles and responsibilities A I

6.1.2 Segregation of duties A I6.1.3 Contact with authorities A

6.1.4 Contact with special interest groups A

6.1.5 Information security in project management A

6.2.1 Mobile device policy A I

6.2.2 Teleworking A I

7.1.1 Screening A

7.1.2 Terms and conditions of employment A I

7.2.1 Management responsibilities A I

7.2.2 Information security awareness, education and training A I

7.2.3 Disciplinary process A I

7.3.1 Termination or change of employment responsibilities A I

8.1.1 Inventory of assets A

8.1.2 Ownership of assets A

8.1.3 Acceptable use of assets A I

8.1.4 Return of assets A I

8.2.1 Classification of information A I

8.2.2 Labelling of information A I

8.2.3 Handling of assets A I

8.3.1 Management of removable media A I

8.3.2 Disposal of media A I

8.3.3 Physical media transfer A I

9.1.1 Access control policy A

9.1.2 Access to networks and network services A I

9.2.1 User registration and de-registration A

5 Information security policies

6 Organizing information security

7 Human resource security

8 Asset management

9 Access control


7/13

9.2.2 User access provisioning A

9.2.3 Management of privileged access rights A

9.2.4 Management of secret authentication information of users A

9.2.5 Review of user access rights A

9.2.6 Removal or adjustment of access rights A

9.3.1 Use of secret authentication information A I

9.4.1 Information access restriction A I

9.4.2 Secure log-on procedures A

9.4.3 Password management system A

9.4.4 Use of privileged utility programs A I

9.4.5 Access control to program source code A I

10.1.1 Policy on the use of cryptographic controls A I

10.1.2 Key management A

11.1.1 Physical security perimeter A I

11.1.2 Physical entry controls A I11.1.3 Securing offices, rooms and facilities A I

11.1.4 Protecting against external and environmental threats A I

11.1.5 Working in secure areas A I

11.1.6 Delivery and loading areas A I

11.2.1 Equipment siting and protection A I

11.2.2 Supporting utilities A

11.2.3 Cabling security A

11.2.4 Equipment maintenance A

11.2.5 Removal of assets A I

11.2.6 Security of equipment and assets off-premises A I

11.2.7 Secure disposal or re-use of equipment A I11.2.8 Unattended user equipment A I

11.2.9 Clear desk and clear screen policy A I

12.1.1 Documented operating procedures A

12.1.2 Change management A I

12.1.3 Capacity management A

12.1.4 Separation of development, testing and operational environments A

12.2.1 Controls against malware A

12.3.1 Information backup A

12.4.1 Event logging A12.4.2 Protection of log information A

12.4.3 Administrator and operator logs A

12.4.4 Clock synchronisation A

12.5.1 Installation of software on operational systems A I

12.6.1 Management of technical vulnerabilities A

12.6.2 Restrictions on software installation A I

12.7.1 Information systems audit controls A

12 Operations security

11 Physical and environmental security

10 Cryptography


8/13

13.1.1 Network controls A

13.1.2 Security of network services A

13.1.3 Segregation in networks A

13.2.1 Information transfer policies and procedures A I

13.2.2 Agreements on information transfer A

13.2.3 Electronic messaging A I13.2.4 Confidentiality or non-disclosure agreements A

14.1.1 Information Security requirements analysis and specification A

14.1.2 Securing application services on public networks A

14.1.3 Protecting application services transactions A

14.2.1 Secure development policy A

14.2.2 System change control procedures A

14.2.3 Technical review of applications after operating platform changes A

14.2.4 Restrictions on changes to software packages A

14.2.5 Secure system engineering principles A14.2.6 Secure development environment A

14.2.7 Outsourced development A

14.2.8 System security testing A

14.2.9 System acceptance testing A C

14.3.1 Protection of test data A

15.1.1 Information security policy for supplier relationships A

15.1.2 Addressing security within supplier agreements A

15.1.3 Information and communication technology supply chain A

15.2.1 Monitoring and review of supplier services A15.2.2 Managing changes to supplier services A

16.1.1 Responsibilities and procedures A

16.1.2 Reporting information security events A I

16.1.3 Reporting information security weaknesses A I

16.1.4 Assessment of and decision on information security events A

16.1.5 Response to information security incidents A

16.1.6 Learning from information security incidents A

16.1.7 Collection of evidence A

17.1.1 Planning information security continuity A

17.1.2 Implementing information security continuity A

17.1.3 Verify, review and evaluate information security continuity A

17.2.1 Availability of information processing facilities A

18.1.1 Identification of applicable legislation and contractual requirements A I

18.1.2 Intellectual property rights A I

18 Compliance

13 Communications security

14 System acquisition, development and maintenance

15 Supplier relationships

16 Information security incident management

17 Information security aspects of business continuity management


9/13

18.1.3 Protection of records A I

18.1.4 Privacy and protection of personally identifiable information A I

18.1.5 Regulation of cryptographic controls A

18.2.1 Independent review of information security A

18.2.2 Compliance with security policies and standards A I

18.2.3 Technical compliance review A

Number of responsibilities 0 0

Number of accountabilities 112 0

Number of controls supported 0 0

Number of controls on which consulted 2 1

Number of controls of which informed 0 48


10/13

atio

nAsse

tOwn

ers

Staff

Man

agin

gDirect

or/C

EO

Exec

utive

manag

emen

t

ISMSS

teeringCo

mmitt

ee

Info

rmatio

nSecu

rityM

anag

er

Oper

atio

nsSecu

rityT

eam

Head

ofHR

Head

ofProcure

men

t

Head

ofLeg

al,Com

plian

ce&

DP

Head

ofFina

nce

Faciliti

esManag

emen

t

Head

ofIT/C

IO

Head

ofR&D

Head

ofXX

XXDep

t

C A S R S C S C C C S C

S A R S C S S S S C S S

R S C C C C C

C R C CC S S R

C C R S S

C R S S

C R S C C

R S C C C

S R

S S R

R S S

S R S C

S R

S S R S

S R C

R S S S C

R S C S C S

R C S S C S S

S R C

S R C C C C S S

C S C S R

S S C S R

S C R

S C C R

S R S S C C S

S C S R

S C R S


11/13

S R

C S R S C S

S C C R

S S R C

S S C R

S S R

S C R

S C R

S C S R

S C S R

S C S R

S R S

S R S

S C R C

S C R CS C R C

S C R C

S C R

S C R

S C R

S C R C

S C S R

S C R

S C R

S C C R

S C S RS C S R

S C S R

C S R

S R S S S C

S R S C S C

S R C S S

S C S C R C

R S C S S

S S C S S RS S R C S S

S R S S

C S R

S C C R

S S S R

S S S R

S S R S S C


12/13

S C S R

S C R

S C R S

S R S

S R S S

S S C C RS S S S R S S

C S R C C C

C R S S S C

S C S R

C S S S R

C S R C S C

S R S

S S S R C

R S S SS S S R

S S C S R

S R S S S

S S S R

R S S S S

C R S

S R S S

S R S

S C RS S R

R S S C S S

S R S S S

S R S S S

R S S C S S

S R S C S S

R S C C C C C C

R S C S S

S R S S

S S R S S

R S S S

S S S R S

R S S S S S S

C R S S C S


13/13

R S S S S

C S S R S

R C S

R S C

S R C S

S R C S

2 8 22 23 0 3 1 5 0 11 35 4 0 0

0 2 0 0 0 0 0 0 0 0 0 0 0 0

1 21 82 33 29 9 8 4 3 20 51 5 0 0

3 11 3 40 12 6 7 13 6 5 14 12 0 0

0 0 0 0 0 0 0 0 0 0 0 0 0 0

Documents

Iso27001 Rasci Table v3