Annex A.6 - Organisation of Information Security

Organisation of information security: This control requires organisations to assign roles and responsibilities for information security, and to establish a framework for managing information security risks.