Which statement regarding organizational roles, responsibilities, and authorities is NOT correct?

This statement is incorrect. According to ISO/IEC 27001:2022, Clause 5.3, top management is required to assign the responsibility and authority for reporting on the performance of the Information Security Management System (ISMS). While top management retains ultimate accountability for the ISMS, the standard explicitly mandates the delegation of the reporting task. The clause states that top management shall assign responsibility for "reporting on the performance of the information security management system to top management." Therefore, the claim that this responsibility cannot be assigned to someone else directly contradicts the standard.

B. The standard does not prescribe which organizational roles must be assigned information security responsibilities, allowing for flexibility based on the organization's context.
C. This is a direct requirement outlined in ISO/IEC 27001:2022, Clause 5.3 a), which states top management must assign responsibility for ensuring the ISMS conforms to the standard.

1. International Organization for Standardization (ISO). (2022). ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection — Information security management systems — Requirements. Section 5.3, "Organizational roles, responsibilities and authorities". This clause specifies that top management shall assign the responsibility and authority for: "a) ensuring that the information security management system conforms to the requirements of this document; and b) reporting on the performance of the information security management system to top management." This directly refutes option A and confirms option C.

2. PECB. (2022). Official PECB ISO/IEC 27001 Lead Implementer Training Courseware. Module: "Clause 5: Leadership". The material for Clause 5.3 explains that while top management is accountable, it must delegate the operational responsibilities for ISMS conformity and performance reporting to relevant roles within the organization.

3. University of Oslo. (2023). INF5261 – Development of Secure Information Systems, Lecture on ISMS Implementation. Department of Informatics. The course material covering ISO/IEC 27001 Clause 5, "Leadership," clarifies that a key function of top management is the assignment of specific ISMS-related duties, including reporting, to ensure operational effectiveness and clear lines of authority. This supports the validity of options B and C.