ISO 27001 · clause 7
Hours and budget, agreed by management
A role list with evidence for each person
Staff who can answer the question
What, when, to whom, how
Rules and proof, current and controlled