Question:Which statement regarding organizational roles, responsibilities, and authorities is NOT correct?

ISO/IEC 27001:2022 Clause 5.3 – Organizational roles, responsibilities, and authorities clearly states:

"Top management shall assign the responsibility and authority for:

a) ensuring that the ISMS conforms to the requirements of this document;

b) reporting on the performance of the ISMS to top management."

This means top management is not solely responsible for directly reporting on performance—it can assign this responsibility to a qualified individual (such as an ISMS manager, CISO, or another responsible party). Therefore, Option A is incorrect and violates the intent of Clause 5.3.