Clearly documenting and communicating the information security roles and responsibilities of all personnel is crucial for an effective security program. By ensuring everyone understands their part in protecting the organization's information assets, risks can be better managed. The effort spent defining and communicating roles and responsibilities pays off by reducing confusion and mistakes that could lead to security incidents.

Where did this come from?

This control comes from the CSA Cloud Controls Matrix v4.0.10 - 2023-09-26, which can be downloaded from https://cloudsecurityalliance.org/artifacts/cloud-controls-matrix-v4. The CCM provides a comprehensive set of cloud security controls mapped to various industry standards. For more background, the CSA provides an overview of the CCM and its use cases at https://cloudsecurityalliance.org/research/cloud-controls-matrix.

Who should care?

• CISOs and security managers responsible for the organization's overall security posture
• HR managers involved in hiring, onboarding, and managing personnel
• IT managers overseeing systems and data that need to be protected
• Compliance officers ensuring the organization meets its regulatory obligations
• Employees at all levels who have a role to play in information security

What is the risk?

Failing to properly define and communicate security roles and responsibilities can lead to:

• Employees being unaware of their security obligations, leading to risky behavior
• Inconsistent application of security controls across the organization
• Lack of accountability for security failures
• Difficulty responding effectively to security incidents due to confusion over who is responsible for what
• Regulatory non-compliance if mandated roles are not established

While having documented roles and responsibilities won't completely eliminate human error, it can significantly reduce unintentional mistakes and oversights.

What's the care factor?

Every organization should place a high priority on this control. The larger and more complex the organization, the more critical it becomes. Without clearly defined roles, important security tasks may be overlooked, not carried out properly, or raise accountability issues. In the event of a security incident or regulatory audit, being able to demonstrate that roles were defined and communicated is important.

For smaller, less complex organizations, the level of formality and detail required may be less. But some level of documented role definition is always better than having no explicit responsibilities.

When is it relevant?

Role definition is relevant in virtually all situations as a fundamental security practice. The specific roles required may vary depending on the organization's size, industry, regulatory environment, and technical complexity. But there are very few cases where no explicit security responsibilities are needed.

Situations where this control is especially important include:

• Organizations subject to compliance requirements that mandate certain roles
• Organizations experiencing rapid growth where ad hoc responsibilities break down
• Post-incident, where a lack of clear roles was a contributing factor
• Organizations implementing new, unfamiliar technologies that require specialize skills

What are the trade offs?

Implementing this control requires an investment of time from security, HR, IT and other managers to document roles. The broader the set of roles defined, the more time this takes. It also requires time to communicate and reinforce the roles to personnel on an ongoing basis.

For new hires, it requires committing time during the onboarding process to communication security responsibilities. For existing personnel, it may require new training and changes to accustomed ways of working.

More granular segregation of duties for security-critical tasks provides stronger risk management but reduces flexibility in personnel assignments and may require more staff.

How to make it happen?

1. Identify all information assets and systems in scope for the security program. Understand the sensitivity and criticality of each.
2. Document the security processes and procedures required to protect the in-scope assets. Note specific tasks such as configuration reviews, access provisioning, monitoring, etc.
3. Define roles required to carry out the identified security tasks. Typical roles include:

• CISO - overall responsibility for the security program
• Security Architect - designs secure systems
• Security Engineer - configures and maintains security controls
• Security Analyst - monitors for and investigates security events
• Data Owner - responsible for categorizing sensitivity of information assets
• System Owner - responsible for security of a specific application or system

4. For each role, document:

• Purpose of the role
• Specific responsibilities
• Qualifications required
• What level of access to systems and data is required
• Who the role reports to
• Any relevant compliance requirements

5. Assign personnel to each of the defined roles based on their qualifications.
6. Communicate the role definitions to personnel. This can be done via:

• Inclusion in job descriptions
• Onboarding training
• Regular refresher training
• Easily accessible reference documentation

7. Include security responsibilities in annual performance goal setting and appraisals.
8. Get sign-off from executives and legal on role definitions. This is especially important for roles involved in handling regulated data.
9. Schedule periodic reviews of role definitions to ensure they remain aligned with the organization's structure, technologies and risks.

What are some gotchas?

• Role definitions that are too broad or vague may not provide sufficient clarity on responsibilities. Strive to be as specific as possible about expected tasks and decision authorities.
• Failing to update role definitions as the organization and technology environment changes. Treat role definitions as living documents.
• Not providing adequate training to personnel at first assignment to a role. Security tools and techies change over time, requiring refresh training.
• Organizations often overlook the need to define data ownership roles. Data owners need to understand their responsibility for classifying sensitivity.
• Regulated organizations need to research specific compliance mandates for roles. For example, PCI DSS Requirement 12 specifies information security management responsibility. HIPAA mandates appointment of a Privacy Officer.

What are the alternatives?

There is no alternative to defining security roles and responsibilities in some form. Less formal approaches such as relying on informal understanding need to be replaced as organizations scale up. The level of detail and formality of roles definitions can vary but the minimal viable level of documentation needs to ensure important responsibilities do not fall through the cracks.

Explore further

• CIS Critical Security Control 14 is "Security Awareness and Skills Training" and requires assignment of security roles and responsibilities (CIS Control 14.1 and 14.5)
• CISSP domain on "Security and Risk Management" addresses organizational roles (CISSP Exam Outline 1.8)

Other reference material on security roles and responsibilities:

• NIST Special Publication 800-181 rev 1 provides a comprehensive workforce framework for cybersecurity (NICE Framework)
• ISACA provides resources and certifications for different security roles such as CISA and CISM (https://www.isaca.org)

‍