Assign governance roles and accountabilities

Assign governance roles and accountabilities

— Who acts, and who decides?

At a new-service launch meeting, the technology lead says the security team is “responsible for everything security related.” Security assumes the service owner will decide if risk remains. Nobody objects. When an external provider later fails, the enterprise discovers that no one has authority to decide whether to keep the service running through the outage. The defect is not a missing name in a directory. It is a missing decision right. Governance says who recommends, funds, implements, reviews, and accepts a consequence for the business.

Distinguish three kinds of ownership. A risk owner is accountable for a scenario's effect on a business objective and participates in choosing a response and accepting residual exposure within delegated authority. A control owner operates a treatment and measures its performance, such as access management or backup testing. The security function develops policy and methods, advises decision makers, and reports risk and compliance. These roles may sit with the same people in a small enterprise, but shared staffing does not remove the need for explicit authority and suitable review. An analyst may contain a live event under a response plan without acquiring permanent authority to accept strategic business risk.

Consider a payment service that depends on an identity provider. Security records that an outage can prevent some customers from completing a purchase and proposes a fallback channel. The platform team builds the integration and tests switching time. The payment service owner states the impact and the limit they may accept, escalating if that limit or an enterprise obligation is exceeded. An oversight or audit function, depending on the organization, may review whether evidence and thresholds are consistent. Review does not make it the risk owner. A useful decision record identifies the role, not only today's employee, and includes the authority limit, date, and condition that requires reconsideration.

Test the allocation with a counterfactual. If an outage changes from a few failed orders to a full day of lost revenue, does the same person retain acceptance authority? Probably not if escalation thresholds are tied to impact. Do not invent a universal monetary threshold: each enterprise defines its own. If a team's delegation conflicts with a contractual commitment, security should not quietly accept ambiguity. It should describe the consequence of delay and possible interim controls, then raise the conflict to the authorized level.

The distinction between advice and decision also matters in an exam case. The security manager's best action may be to develop two options and present evidence to a committee or process owner even under pressure to select a tool quickly. Read words such as “first,” “most appropriate,” and “authorized,” then link the response to the business objective and the stated delegation. “Always the board” and “always the security manager” are both poor shortcuts because each ignores the decision structure given in the case.

Test delegation before a crisis with a small decision exercise. Show the service owner a recovery test that took three hours against a two-hour accepted limit. Ask whether they can accept the gap for one week, which service is affected, and what interim action applies. If they say the backup team decides because it ran the test, explain that the team establishes performance but does not alone own customer outage impact. If they automatically send it to the board, inspect the actual escalation rule; an operating committee may have delegated authority. The output is not a memorized job title but an evidence-owner-impact-limit chain that survives staff changes. A shared identity control may serve payment and internal reporting, yet their business consequences differ. Platform operations can own one control test; each process owner assesses the relevant effect. A joint authority resolves a single treatment budget when their interests conflict.