Page 365 - CyberSecurityEssentialsEnglish

FIGURE 8-3: A SCALABLE INSTITUTIONAL GOVERNANCE STRUCTURE

What to notice: Four layers running from leadership through delivery and specialist oversight

to independent assurance, with relative separation between those who build, those who
approve, and those who review.

Source: Prepared by the author.

A Responsibility Matrix to Clarify Roles
A responsibility matrix helps identify who carries out the work, who is accountable for the
final outcome, who is consulted, and who is informed. The most important rule is that every
significant decision has at least one person who is finally accountable, even where many

people take part in delivery and review.

TABLE 8-3: A SIMPLIFIED DISTRIBUTION OF RESPONSIBILITIES

Decision Responsible Accountable Consulted Informed

Registering a use The team The process The governance
Risk and data.
case proposing it. owner. function.

Classifying the risk The use-case The governance Legal, privacy, Leadership for
level owner. function. security. high impact.

Approving before The delivery The named Specialist
Affected units.
release team. decision owner. reviewers.

Granting executive Security The system
Risk and legal. Internal audit.
permissions engineering. owner.

Retiring or stopping The process Users and
Operations. Leadership.
a system owner. vendors.

364