Clause 10 · Title coverage

Responsibilities

Clause 10 closes the loop on ownership. It covers the general allocation of responsibility, the documentation that proves it, and the implementation that makes it real, including the deletion mechanisms the framework relies on.

Citation: ISO/IEC DIS 27555, Clause 10. Held: Contents only.

What the draft asks of an organisation

The clause asks the organisation to say which role answers for the deletion rules, which answers for the processes and which answers for the documentation. The public contents splits it into general responsibilities, documentation and implementation. The general part is the role map. The documentation part is the evidence that the roles were exercised, not only named. The implementation part is where the organisation shows that the mechanisms and the operating routine exist, which the earlier clauses deliberately left outside their own scope. A responsibility that is named in a policy but never appears in a job description, a review or a ticket is a name without a control. The clause is short, and its test is simple: for each cluster and each step, can the organisation name a person and show the last time that person acted?

What the public sample holds

The DIS contents lists 10.1 General, 10.2 Documentation and 10.3 Implementation. The clause text is not in the public sample and is not held. This page states the ownership work the framework implies, not the draft's sentences.

What this clause covers, in our reading

Ownership is the difference between a framework that survives a staff change and one that dies with its author. The draft separates three layers because they fail in different ways. General responsibility fails when a role exists on an organisation chart but has no time, no delegation and no authority to stop a release. Documentation fails when the register, the matrix and the procedure exist but nobody can show which version was in force on the day a record should have gone. Implementation fails when the policy says deletion and the estate says otherwise, because the mechanism was never funded or the application owner never changed the job. A workable model names a framework owner, a cluster owner for each cluster and an operator for each deletion route. The framework owner keeps the vocabulary and the matrix. The cluster owner decides the purpose, the period and the exceptions. The operator runs the deletion and records it. The three roles can sit in one person in a small organisation, but the record should still show which hat was worn. The documentation layer is also where the organisation records the deletion mechanisms it relies on, because clause 10.3 is the point at which the mechanisms excluded from clause 1 come back as an implementation responsibility. A reviewer will ask for the last run, the last exception and the last change to the matrix. If the answer is a document rather than a person and a date, the clause has not been met.

Subclauses named in the contents

• 10.1 General
• 10.2 Documentation
• 10.3 Implementation

What to prepare

1. Write a role map with a framework owner, a cluster owner for every cluster and an operator for every route.
2. Put the deletion duties into the job descriptions and objectives of the named people.
3. Keep a controlled document register with the version in force and the date it took effect.
4. Record the deletion mechanisms the organisation relies on and who maintains each one.

The evidence an auditor or regulator asks for

Tests to run

• Ask each named owner to describe the decision they are allowed to make.
• Pick a date in the past and confirm which version of the procedure was in force.
• Pick a mechanism and ask who owns it and when it was last tested.

What the public text does not settle

• The clause text is not in the public sample and is not stated here.
• The draft does not prescribe role titles or an organisational design.
• The draft does not say how the roles are resourced.

Next

• Publish the role map with the policy.
• Add the document register and the mechanism register to the audit pack.

Other clauses

• Clause 1: Scope
• Clause 2: Normative references
• Clause 3: Terms and definitions