# ISO/IEC 27701 A.3.4 — Information security roles & responsibilities

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_iso27701_a34_d319714bd0-isoiec-27701-a34-information-security-roles-responsibilities
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [ISO/IEC 27701 (Privacy Information Management)](https://support.icompaas.com/support/solutions/c_gen_iso27701) › [Security considerations](https://support.icompaas.com/support/solutions/folders/f_gen_cgeniso27701_securityconsiderations)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

ISO/IEC 27701 · Control A.3.4 · Priority: high · Component: Security considerations

### What this control covers

Define and allocate security roles and responsibilities related to PII processing. Implementation: Create role descriptions, appoint contacts (e.g., DPO / Privacy Officer). Justification: Clarifies accountability for PII security.

### Why it matters

Risk is the language an executive team understands; this control connects technical reality to board-level decisions and budget allocation.

### How to implement

#### AWS

Codify the policy intent as **SCPs, AWS Config conformance packs, and Security Hub standards** so the cloud enforces what the document says.

#### Azure

Codify in **Azure Policy initiatives** (built-in regulatory compliance for CIS, ISO 27001, SOC 2, HIPAA) and assign at management-group level.

#### Google Workspace

Use **Data Export** (Takeout-style) and **Vault search** to scope DSARs. Apply **Drive labels + DLP** so personal data classes are discoverable.

#### On-premises

Maintain a policy library with a documented review cadence (annual minimum); store in your GRC tool with attestation tracking. Map each policy to controls so an audit pull cites the exact policy clause.

### Evidence to collect

-   `policy_document` — A signed, version-controlled policy stating leadership intent and the named owner.

Signed policies, procedures, and registers document the safeguard. Focus: Information security roles & responsibilities.

### Quick checklist

-   Implement — Information Security Roles / Responsibilities
-   Define — Information Security Roles / Responsibilities
-   Appoint — Information Security Roles / Responsibilities

### Related articles on this site

-   [NIST 800-171 3.2.2 Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities.](https://support.icompaas.com/support/solutions/articles/62000229266-nist-800-171-3-2-2-ensure-that-personnel-are-trained-to-carry-out-their-assigned-information-security)
-   [CMMC 2.0 AT.2.057 Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities.](https://support.icompaas.com/support/solutions/articles/62000229423-cmmc-2-0-at-2-057-ensure-that-personnel-are-trained-to-carry-out-their-assigned-information-security-)
-   [Ensure security contact information is registered](https://support.icompaas.com/support/solutions/articles/62000081061-ensure-security-contact-information-is-registered)
-   [Ensure ELB uses predefined security policy (ssl)](https://support.icompaas.com/support/solutions/articles/62000219192-ensure-elb-uses-predefined-security-policy-ssl-)