# Clause 5.3: Roles, responsibilities and authorities

Top management must assign and communicate the responsibilities and authorities for the roles the BCMS depends on, and must specifically assign responsibility and authority for ensuring the BCMS conforms to the standard and for reporting BCMS performance back to top management.

Cloud: Provider incidents fail on the handover between teams. Assign one role that owns the relationship during an incident, one that owns the technical recovery, and one that owns the customer message, and write the names into the plan.

Evidence: Role descriptions or a responsibility matrix covering BCMS roles; Named individual accountable for BCMS conformity; Named reporting line and evidence of performance reporting to top management; Evidence the assignments were communicated.

Test: Check that the escalation path names a role for provider contact, technical recovery and customer communication.

Citation: ISO 22301:2019, clause 5.3. Source: https://compliance.theartofservice.com/frameworks/iso-22301-2019. Last updated: 2026-10-20.