Requirement
"Information security roles and responsibilities shall be defined and allocated according to the organization needs."[1]
Explanation
Assigning information security roles ensures that the organization's information security policy is carried out by authorized persons. Examples of roles include the system owner system security officer and facility security officer.
