Cybersecurity policy, roles, and stakeholder coordination
What the exam tests
Questions focus on the cybersecurity policy as a top-management instrument, the roles that make it operational, and coordination among stakeholders who do not share a single hierarchy: governments, providers, organizations, users, law enforcement and CSIRTs.
Policy content
A credible policy states purpose and scope, aligns with legal, regulatory and business requirements, sets objectives and risk appetite, assigns accountability, requires incident reporting and awareness, and commits to review and continual improvement. It should be approved at the appropriate management level and communicated to staff, suppliers and relevant external parties.
Roles and coordination
- Top management is accountable; a cybersecurity manager or CISO coordinates; asset and risk owners accept risk; all users comply.
- External coordination needs a legal basis: contracts, memoranda of understanding, information-sharing agreements, clear points of contact and handling rules for personal or confidential data.
- A CSIRT or CERT is a coordination hub, not the owner of every business risk.
- Awareness and training must be role-based; measure behavior and completion, not only attendance.
Worked example
A bank joins an ISP-led threat-intelligence group. Before sharing indicators, the bank classifies the data, removes customer identifiers, checks contractual and privacy constraints, names an escalation contact and agrees what the ISP will do with the data. The reasoning: coordination is a governed process, not an email list.
Traps
Treating policy as an IT document; assigning responsibility without accountability; sharing threat data without legal or privacy review; assuming a CSIRT owns business risk; ignoring suppliers and external stakeholders.