Cybersecurity Governance: Who Is Responsible for Security?
By: Heather Lange-Wilson
Who is responsible for cybersecurity?
The cybersecurity team?
IT?
Management?
Employees?
The answer is all of them - but they have different
responsibilities.
Cybersecurity governance establishes how an organization
directs, manages, and oversees its cybersecurity program.
It helps answer questions such as:
Who makes security decisions?
Who owns cybersecurity risks?
Who approves policies?
Who ensures requirements are followed?
Who is accountable when corrective action is required?
Without governance, security decisions can become
inconsistent and responsibilities unclear.
What Is Cybersecurity Governance?
Governance provides organizational direction and oversight.
It connects cybersecurity with:
- Business
objectives
- Risk
management
- Policies
- Legal
requirements
- Regulatory
requirements
- Leadership
responsibilities
- Accountability
Cybersecurity governance ensures security is treated as an
organizational issue rather than simply a technical problem.
Leadership Responsibilities
Leadership establishes priorities and determines acceptable
levels of organizational risk.
Senior management may be responsible for:
- Approving
policies
- Allocating
resources
- Reviewing
significant risks
- Establishing
accountability
- Supporting
security initiatives
Technical staff can explain vulnerabilities and recommend
controls, but some risk decisions ultimately require business leadership.
Security and IT Responsibilities
Cybersecurity and IT teams may implement and operate
controls such as:
- Firewalls
- Endpoint
protection
- Identity
management
- Logging
- Vulnerability
management
- Incident
response
- Security
monitoring
They may also provide technical guidance to leadership.
However, IT should not be expected to make every
organizational risk decision alone.
Risk Owners
Organizations may assign risk owners.
A risk owner is responsible for overseeing a particular risk
and ensuring it is appropriately managed.
Ownership creates accountability.
Instead of saying:
“Someone should fix this,”
the organization can identify who is responsible for
tracking the issue and making sure appropriate action occurs.
Policies Create Direction
Security policies translate governance decisions into
organizational expectations.
Policies may address:
- Acceptable
use
- Access
control
- Information
security
- Remote
access
- Data
handling
- Incident
response
- Vendor
management
Policies help employees understand what is expected.
Governance ensures those policies have appropriate authority
and oversight.
Separation of Duties
One important governance principle is separation of
duties.
Critical activities may be divided among multiple people so
one individual does not control the entire process.
For example, the person requesting a significant financial
transaction might not be the same person approving it.
In technology, administrative responsibilities may also be
divided.
Separation of duties can reduce fraud, mistakes, and misuse.
Job Rotation and Mandatory Vacations
Organizations may use job rotation to periodically
move employees between responsibilities.
This can improve cross-training and sometimes help reveal
inappropriate activities that might otherwise remain hidden.
Mandatory vacations can serve a similar control
purpose in certain sensitive positions because another employee must perform
the person's responsibilities during the absence.
These concepts are important within Security+ governance and
security-control discussions.
Policies Need Enforcement
A policy that nobody follows provides limited protection.
Organizations should support policies through:
- Training
- Technical
controls
- Monitoring
- Management
support
- Consistent
enforcement
- Periodic
review
Policies should also remain realistic.
If employees routinely need to bypass a policy to perform
legitimate work, the organization should investigate why.
The solution may involve better technology, a revised
process, additional training, or an updated policy.
Employees Have Governance Responsibilities Too
Employees may not approve cybersecurity budgets or
organizational risk strategies, but they still participate in governance.
Employees are responsible for:
- Following
policies
- Protecting
organizational information
- Completing
required training
- Using
approved systems
- Reporting
security concerns
- Following
access requirements
- Asking
questions when requirements are unclear
Governance works only when organizational expectations
translate into everyday behavior.
Accountability Does Not Mean Blame
Accountability means understanding who is responsible for
particular decisions and actions.
It should not automatically mean finding someone to blame
whenever something goes wrong.
Effective organizations examine incidents to understand:
What happened?
Why did it happen?
Which controls failed?
What should change?
Lessons learned can strengthen governance and prevent
repeated problems.
Metrics and Oversight
Leadership needs information to understand whether the
cybersecurity program is working.
Organizations may monitor metrics such as:
- Security
incidents
- Vulnerability
remediation
- Training
completion
- Phishing
simulation results
- Patch
compliance
- Vendor
assessments
- Audit
findings
- Risk
remediation
Metrics should help leaders make informed decisions rather
than simply generate reports.
Cybersecurity Is an Organizational Responsibility
The cybersecurity department cannot protect an organization
alone.
IT cannot protect an organization alone.
Leadership cannot protect an organization alone.
Employees cannot protect an organization alone.
Effective cybersecurity requires each group to understand
its responsibilities.
Leadership provides direction.
Security teams provide expertise and oversight.
IT implements and operates technology.
Managers enforce expectations.
Employees follow requirements and report concerns.
Governance connects those responsibilities.
Knowledge Check
1. What is cybersecurity governance primarily concerned
with?
A. Organizational direction, oversight, responsibility, and
accountability
B. Installing printers
C. Increasing internet speed
D. Replacing all policies
Answer: A
2. What is a risk owner?
A. Someone responsible for overseeing and managing an
assigned risk
B. Every external attacker
C. A software vendor
D. A backup administrator only
Answer: A
3. What is separation of duties?
A. Giving one person complete control
B. Dividing critical responsibilities among multiple people
C. Eliminating management
D. Sharing administrator passwords
Answer: B
4. Why might organizations use mandatory vacations in
certain sensitive positions?
A. They can require someone else to perform the employee's
responsibilities, potentially revealing irregularities.
B. They eliminate cybersecurity risk.
C. They replace audits.
D. They prevent employees from receiving training.
Answer: A
5. Who is responsible for organizational cybersecurity?
A. Only IT
B. Only executives
C. Only the security department
D. Multiple groups throughout the organization, with different responsibilities
Answer: D
Security+ Quick Review
Governance = Organizational direction and oversight
Risk Owner = Person responsible for overseeing an
assigned risk
Separation of Duties = Dividing sensitive
responsibilities
Job Rotation = Periodically changing responsibilities
Mandatory Vacation = Requiring time away so another
person performs sensitive duties
Security Metrics = Measurements used to evaluate and
oversee security performance
Accountability = Clearly establishing responsibility
for decisions and actions
Final Takeaway
Cybersecurity is not simply an IT responsibility.
Technology teams may operate the systems, but leadership
establishes direction, managers support enforcement, risk owners manage
identified risks, and employees make security-related decisions every day.
Good governance makes those responsibilities clear.
When everyone understands their role, cybersecurity becomes
part of how the organization operates - not simply something the security
department does.
