Roles and responsibilities are documented jointly in Information Security Policy. Roles and responsibilities of employees, contractors and third party suppliers should be defined and documented according to this policy. The relevant roles and responsibilities should be clearly communicated to job candidates during the pre-employment process. They should include the requirement to:
• Implement and act in accordance with the information security policies,
• Protect the organization’s assets from unauthorized access, disclosure, modification, destruction or interference,
• Carry out and comply with security processes and activities detailed within their job description,
• Ensure that responsibility is assigned to individuals for actions taken,
• Report actual or potential security events or risks to MIS team.