Requirement:

The asset owner shall have policies and procedures around defining and assigning security roles and responsibilities to qualified personnel, including employees, contractors, subcontractors and consultants.

Guidance: