ISO 27001 · clause 5
Eight duties in the standard. Four things in practice.
Budget and headcount decisions. Management review records with decisions in them.
One short document. Seven requirements sitting inside it.
The policy itself, plus proof that people were told about it.
Two jobs with a name on them, and the authority to go with it.
A written assignment the named person has actually seen.