[Autogenerated] we're still thinking about responsibilities on
Requirement 12.5 wants to make sure that responsibility has been
allocated for five key information security activities.
But the requirements clear that each of these responsibilities
doesn't need to be given to just one individual.
It could be a whole team's responsibility now if you followed
my earlier advice to put responsibility and accountability in
your information security policy.
You have already met this requirement because although the
standard just list five main security functions here,
I found the allocating responsibility for all of the
security requirements in PC GUID.
CSS really makes maintaining peace GUID CSS compliance much easier.
There's a hidden requirement in the testing procedure for 12.5.
It asked the use A to examine the policies and procedures on the first thing.
The use A is looking for is someone who is being given overall
responsibility for information security in the organization.
And yes,
that's not written in the requirements is just in the testing procedures.
So don't let that catch you out.
Then the QoS a has got to look for the five information security activities
where this requirement demands that responsibility is defined,
and these five are given in the sub requirements.
They are the authoring and management security policies,
monitoring and analyzying alert,
which I'd also extend to responding to its security events and making sure
they're acted upon managing the incident response process on making sure the
processes error followed in the event of an incident.
User account management.
So basically identity management.
And finally it's close friend access management,
or specifically, is the standard is written.
Access to data QoS is test is the same for all five sub requirements,
which is to verify that the respective responsibilities being assigned on
they're going to do this by checking the policies on procedures.