Annex A.6 - People Controls

Organisation of information security: This control requires organisations to assign roles and responsibilities for information security, and to establish a framework for managing information security risks.