Zum Hauptinhalt springen
CENEDRIL WIKI
DE
Starter Kit · Register

RACI Matrix

Updated on 2 min Reviewed by: Cenedril-Redaktion
Clause 5.3 ISO 27001NIS2 Art. 21

The RACI matrix answers a question that comes up in every ISMS audit: who is responsible for what? ISO 27001 Clause 5.3 requires that roles, responsibilities, and authorities for information security are assigned and communicated. The matrix is the tool you use to document that.

What does it contain?

The template lists typical ISMS tasks in rows and ISMS roles in columns. Each cell contains one of the four letters R, A, C, or I. The pre-populated tasks cover the entire PDCA cycle:

  • Risk management — risk identification, risk assessment, risk treatment, monitoring
  • Policies — drafting, approval, communication, annual review
  • Operations — incident handling, change management, business continuity
  • Assurance — internal audits, management review, corrective actions
  • People — onboarding, training, offboarding

How to use the template

1. Adapt the roles. The column headers contain generic roles (CISO, IT Management, Executive Management, Business Unit, HR). Replace them with the actual roles or individuals in your organisation.

2. Add or remove tasks. The pre-populated tasks are a starting point. Add tasks specific to your scope (e.g. cloud security reviews, penetration tests, data protection impact assessments). Remove what does not apply.

3. Assign the letters. For each task: assign exactly one A. R can apply to multiple people. C and I as needed. Empty cells are fine — they mean the role has no defined involvement in that task.

4. Communicate. The matrix belongs in the ISMS document register and must be accessible to everyone involved. Anyone who holds a role needs to know it is documented — and what it entails.

5. Maintain. Every organisational change triggers a review. New role? Add a column. Department dissolved? Redistribute tasks. The matrix is a living document.

Register Template

RACI Matrix

.csv · EN.csv · DE
ActivityTop ManagementInformation Security Officer (ISO)IT Operations LeadHR LeadData Protection OfficerDepartment HeadsAll Employees
Approve Information Security PolicyARCCCII
Maintain Risk RegisterIARCCCI
Perform Risk AssessmentsIARCCRI
Approve Risk Treatment PlanARCICCI
Maintain Statement of ApplicabilityIA/RCICII
Conduct Internal AuditsARCICII
Run Management ReviewA/RRCCCCI
Manage Security IncidentsIARICCR
Manage Access RightsIARCIRI
Run Awareness TrainingIACRCCR
Classify InformationIACCCRR
Approve Changes (CAB)ICA/RIICI
Vulnerability & Patch ManagementIARIIII
Supplier Security ReviewIACICRI
Business Continuity PlanningARRCIRI
Handle Subject Access RequestsICCCA/RII
Maintain Asset RegisterIARIIRI
Report Security IncidentsIACCCRR
Key Management (Cryptography)IARIIII
LegendR = ResponsibleA = AccountableC = ConsultedI = Informed

Sources

ISO 27001 Controls Covered

Clause 5.3 Organisational roles, responsibilities and authorities

Frequently asked questions

What do R, A, C, and I stand for?

R = Responsible (does the work), A = Accountable (owns the outcome and approves it), C = Consulted (provides input before the decision), I = Informed (notified after completion). Each task must have exactly one A — otherwise accountability dissolves.

Does a small company really need a RACI matrix?

Especially small companies. When one person wears multiple hats, the matrix reveals where segregation of duties breaks down and where overload builds up. Auditors ask for documented responsibilities regardless of company size.

How often should the RACI matrix be updated?

After every organisational change (new department, personnel change, restructuring) and at least annually during the management review. An outdated matrix is worse in an audit than no matrix — because it actively provides wrong information.