Security Organization and Responsibilities
What this domain tests
Security organization and responsibilities tests accountability: who owns information, who operates controls, who approves access, and how duties are separated. Expect RACI models, reporting lines, committees, and third-party roles.
Core rules
- The data owner, usually a business manager, is accountable for classification and access rules.
- The data custodian implements and maintains controls.
- The system owner is accountable for the system's security throughout its lifecycle.
- Users comply with policy and report incidents.
- Segregation of duties prevents one person from requesting, approving, and implementing a sensitive change.
- Security should have independent reporting to reduce operational conflicts; internal audit should not report to the CISO.
- Outsourcing transfers tasks, not accountability.
Worked example
An employee requests finance system access. The manager approves business need; the data owner approves the role; IT provisions it; the access reviewer checks it quarterly. The same administrator cannot both approve and grant privileged access. If the request is for a privileged role, security reviews the control design, but the system owner still accepts the risk. Reasoning: accountability sits with business ownership, implementation with custodians, and checks are separated.
Traps
- Treating 'security owns all risk' as a valid model.
- Writing vague statements that 'management is responsible' without naming roles.
- Letting one person control an end-to-end privileged change.
- Assuming an outsourced provider absorbs all accountability.