Professional Documents
Culture Documents
ISO27k RASCI Table v3
ISO27k RASCI Table v3
The RASCI table associates rles in the organization with the sections of ISO/IEC 27002.
The roles are identified as R,A,S,C or I, meaning:
- Responsible
Accountable i.e.
i.e. this
this rle
rle has
will primary
be calledresponsibility
to account iffor
theperforming the activities
risks materialize in becau
(usually this s
holder
- Supportive i.e. this rle actively assists with the design, implementation or managemen
- Consulted i.e. this is a hands-off rle, offering guidance and direction to those more activ
- Informed i.e. this rle has an interest in the status of the risks in this section and should
Some organizations are prefer the simpler RACI, and that's fine: this is simply a tool to he
to the Information Security Management System. Use it as you wish. Add more rles, cha
The contents of the RASCI table in the ISO27k Toolkit merely demonstrate how we envis
many gaps and innacuracies. Customize the table as much as you like. Do not feel in an
it's probably best to delete them all and start afresh
Notice that as you enter R/A/S/C/I, the cells are automatically colour coded for you using Ex
Copyright
This work is copyright 2014, ISO27k Forum, some rights reserved. It is licensed unde
Share Alike 3.0 License. You are welcome to reproduce, circulate, use and create derivat
incorporated into a commercial product, (b) it is properly attributed to the ISO27k Foru
published or shared, derivative works are shared under the same terms as this.
ss
A
Section of ISO/IEC 27002:2013
on
f ti
ta a
R = Responsible A = Accountable S = Supportive C = Consulted
S rm
I = Informed
fo
In
5 Information security policies
5.1.1 Policies for information security C
5.1.2 Review of the policies for information security C
8 Asset management
8.1.1 Inventory of assets A
8.1.2 Ownership of assets A
8.1.3 Acceptable use of assets A
8.1.4 Return of assets A
8.2.1 Classification of information A
8.2.2 Labelling of information A
8.2.3 Handling of assets A
8.3.1 Management of removable media A
8.3.2 Disposal of media A
8.3.3 Physical media transfer A
9 Access control
9.1.1 Access control policy A
9.1.2 Access to networks and network services A
9.2.1 User registration and de-registration A
9.2.2 User access provisioning A
9.2.3 Management of privileged access rights A
9.2.4 Management of secret authentication information of users A
9.2.5 Review of user access rights A
9.2.6 Removal or adjustment of access rights A
9.3.1 Use of secret authentication information A
9.4.1 Information access restriction A
9.4.2 Secure log-on procedures A
9.4.3 Password management system A
9.4.4 Use of privileged utility programs A
9.4.5 Access control to program source code A
10 Cryptography
10.1.1 Policy on the use of cryptographic controls A
10.1.2 Key management A
12 Operations security
12.1.1 Documented operating procedures A
12.1.2 Change management A
12.1.3 Capacity management A
12.1.4 Separation of development, testing and operational environments A
12.2.1 Controls against malware A
12.3.1 Information backup A
12.4.1 Event logging A
12.4.2 Protection of log information A
12.4.3 Administrator and operator logs A
12.4.4 Clock synchronisation A
12.5.1 Installation of software on operational systems A
12.6.1 Management of technical vulnerabilities A
12.6.2 Restrictions on software installation A
12.7.1 Information systems audit controls A
13 Communications security
13.1.1 Network controls A
13.1.2 Security of network services A
13.1.3 Segregation in networks A
13.2.1 Information transfer policies and procedures A
13.2.2 Agreements on information transfer A
13.2.3 Electronic messaging A
13.2.4 Confidentiality or non-disclosure agreements A
15 Supplier relationships
15.1.1 Information security policy for supplier relationships A
15.1.2 Addressing security within supplier agreements A
15.1.3 Information and communication technology supply chain A
15.2.1 Monitoring and review of supplier services A
15.2.2 Managing changes to supplier services A
Number of responsibilities 0
Number of accountabilities###
Number of controls supported 0
Number of controls on which consulted 2
Number of controls of which informed 0
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
S
ta
S
C
M f
an
S
S
S
S
A
A
R
R
R
R
C
C
C
C
C
R
Ex ag
e in
S
S
S
S
S
S
S
S
S
S
S
S
S
S
S
R
C
R
C
R
R
R
R
C
R
R
IS cu g
M tiv Di
S
S
S
S
S
S
S
S
C
C
R
C
C
R
C
C
R
In S S e rec
S
S
S
C
C
C
C
C
C
fo t ma to
e
O rm er na r/
p C
S
S
S
S
S
S
S
C
C
R
R
C
C
er at ing ge EO
H a io
ea ti n Co me
o
S
S
S
C
C
C
R
H d ns Se mm nt
ea of c
S
S
C
R
C
R
R
C
C
d H S ur it
H e i t
ea of R cu ty ee
r
S
S
C
C
C
C
C H d Pr it Ma
y
ea of o
c
S
S
S
S
S
S
C
C
Te na
Fa d Le ur am ge
r
S
S
S
S
S
S
S
S
R
R
R
R
R
C
C
C
C
C
C
ci of g em
H lit Fin al, e
ea ie a C nt
S
C
C
H d s M nc om
ea of a e p
H d IT na lia
ea of /C g n
ce
X d R IO em
X of &D en &
D X t D
ep X P
t
S C R S
S R
C S R S C S
S C C R
S S R C
S S C R
I S S R
I S C R
S C R
S C S R
I S C S R
I S C S R
I S R S
S R S
I S C R C
I S C R C
I S C R C
I S C R C
I S C R
I S C R
I S C R
S C R C
S C S R
S C R
I S C R
I S C C R
I S C S R
I S C S R
I S C S R
C S R
I S R S S S C
S R S C S C
S R C S S
S C S C R C
R S C S S
S S C S S R
S S R C S S
S R S S
C S R
I S C C R
S S S R
I S S S R
S S R S S C
S C S R
S C R
S C R S
I S R S
S R S S
I S S C C R
S S S S R S S
C S R C C C
C R S S S C
S C S R
C S S S R
C S R C S C
S R S
S S S R C
R S S S
S S S R
S S C S R
S R S S S
C S S S R
R S S S S
C R S
S R S S
S R S
S C R
S S R
R S S C S S
I S R S S S
I S R S S S
R S S C S S
S R S C S S
R S C C C C C C
R S C S S
S R S S
S S R S S
R S S S
S S S R S
I R S S S S S S
I C R S S C S
I R S S S S
I C S S R S
R C S
R S C
I S R C S
S R C S
0 2 8 22 23 0 3 1 5 0 11 35 4 0 0
0 0 2 0 0 0 0 0 0 0 0 0 0 0 0
0 1 21 82 33 29 9 8 4 3 20 51 5 0 0
1 3 11 3 40 12 6 7 13 6 5 14 12 0 0
48 0 0 0 0 0 0 0 0 0 0 0 0 0 0