What does an information security officer do?
The information security officer steers the ISMS: they describe what is needed, agree it with the responsible areas and evidence whether it works. The business functions and IT operations implement the controls. The officer does not decide on residual risks; responsibility for the level of security stays with executive management and the risk owners.
| Area | Content |
|---|---|
| Steering | build, run and develop the ISMS, keep the security objectives current |
| Policies | draft, agree, have approved and maintain the information security policy and supporting policies |
| Risk | coordinate risk analyses, accompany treatment plans, put residual risks to management |
| Operations | assess and escalate security incidents, follow up on actions |
| Evidence | prepare internal audits, compile metrics and the management review |
| Awareness | plan training, be the point of contact for the business functions |
The guide ISMS implementation covers where the role fits when the management system is built.
ISB, CISO and IT security officer
The three titles describe different remits. ISB (Informationssicherheitsbeauftragter) is the German title, also used in IT-Grundschutz, with the focus on running the management system. CISO (Chief Information Security Officer) is the English title; it is used for remits with budget and staff responsibility that extend into strategy and architecture. An IT security officer is limited to IT systems, whereas information security also covers paper, processes and people.
What counts is a written appointment that sets out duties, authority, time budget and reporting line.
Is an information security officer mandatory?
No general German statute requires companies to appoint one, unlike a data protection officer. The BSI Act (BSIG) imposes the duty only on the federal administration: under § 45(1) BSIG, the head of every federal administration body appoints an information security officer and at least one deputy.
For companies, the role follows from standards and supervisory law:
| Basis | What it requires | For whom |
|---|---|---|
| ISO/IECÂ 27001, clause 5.3 | assign and communicate roles and responsibilities for information security; no specific job title | organisations with an ISMS under ISO/IECÂ 27001 |
| IT-Grundschutz, module ISMS.1 (Edition 2023) | management appoints an ISB who can report directly to it when needed and is involved early in major projects and new IT systems | organisations that work to IT-Grundschutz |
| Article 6(4) DORA | a control function for managing and overseeing ICT risk, with an appropriate level of independence | financial entities other than microenterprises |
| § 38 BSIG | management implements and oversees the measures under § 30 BSIG and takes part in training regularly | particularly important and important entities |
§ 38 BSIG addresses management, not the information security officer. An appointment does not relieve management of the duty; it supplies the groundwork without which management can hardly discharge it. If management breaches the duty in paragraph 1, paragraph 2 makes it liable to its own entity for culpably caused damage under company law, and only in the alternative under the BSIG. Under § 28(6) BSIG, § 38 does not apply to financial entities under DORA, and under § 28(5) it does not apply, in principle, to operators of public telecommunications networks and regulated energy companies.
Independence and reporting line
Have the information security officer report directly to management; ISMS.1 requires that they can do so when needed. If you place the role below the head of IT, the officer assesses the results of the unit whose instructions they follow. The same applies when the head of IT takes on the role: they then judge the security of the systems they are responsible for.
If a small company cannot separate the roles, document the conflict. Give the officer a direct right to address management and have their assessments cross-checked at fixed intervals by an independent party, such as internal audit or an external auditor.
Example: put the appointment in writing
Fictional example; company, people and values are invented for illustration. This is what the appointment could look like in a company with 250 employees where the role is part time.
| Item | Provision |
|---|---|
| Role and scope | information security officer for all sites and companies of the group |
| Time budget | 50% of working time, shown in the staffing plan |
| Reporting line | directly to the managing directors; written report every quarter, ad hoc for significant security incidents |
| Authority | access to all systems, contracts and audit reports; escalation to the managing directors without going through the head of IT |
| Involvement | in projects with new IT systems from the planning stage |
| Deputy | a named deputy from risk management |
| Conflict of interest | no officer from IT management; right to address the managing directors |
| Boundary | does not decide on residual risks; puts them to the risk owners and the managing directors |
| Review | yearly, with the management review |
Check the appointment at three points:
- The time budget is in the staffing plan, not only in the appointment letter.
- Quarterly reports exist with date and recipient.
- The deputy is entered in the escalation paths.
If one is missing, add it to the staffing plan, report file or escalation path before you treat the appointment as done.
In-house, external or part time
A part-time role works as long as time budget and authority are fixed. An external officer brings method and comparisons from other organisations. They need an internal contact with access to decisions and defined access to information, systems and committees.
The officer’s report: figures from Rizzqo
For the report to management, Rizzqo computes coverage from the finalised answers to the requirements attached to the assets; each answer carries a name and a timestamp. An owner can be assigned per asset and answers the requirements. Daily snapshots show how coverage has changed since the last quarterly report.
For putting residual risks to management, every risk assessment carries inherent, current and residual risk as separate figures, each from likelihood as a percentage and impact in euros. Controls run as tasks that can be synchronised with Jira in both directions; until completion, their planned reduction lowers only the residual risk.