Team and roles: questions and answers.
Who does what in a management system, and what AskNorman does and does not do.
Which roles does a management system need?
Top management that is accountable and sets policy, an owner of the management system such as a security officer, owners per control in the business, an internal auditor who is independent of the work audited, and where the GDPR requires it a data protection officer.
Do we need a dedicated compliance officer?
Not necessarily. Many organisations start with one security officer or IT manager who coordinates, with control owners in the business. As the number of frameworks and entities grows, a dedicated role usually becomes worthwhile.
What does NIS2 require from management?
Under NIS2 the management bodies of essential and important entities must approve the cybersecurity risk management measures, oversee their implementation and follow training. They can be held liable for infringements.
How do you divide responsibilities per control?
Give every control one owner who is accountable for it working, and record who carries it out, who is consulted and who is informed. In Basenorm each control has an owner, so you can see per standard where ownership is missing.
What does AskNorman do for our team?
AskNorman explains requirements, drafts documents and searches your controls and evidence, in Basenorm or through MCP in a supported AI assistant. Your team assesses and decides; AskNorman does not take compliance decisions.
Book a demo
Your question not answered?
In a demo we answer your questions in the context of your own frameworks and scope.
- Where you stand with ISO 27001 and ISO 42001.
- Which frameworks apply to you.
- How Basenorm keeps your management system current.
Hosted in the Netherlands. Your data stays in the EU.