Who decides, and what does the board see?

An emergency meeting may end with “everyone approved the exception.” Later, operations says it approved a one-day patch delay, security says it approved immediate isolation, and product says it approved continued service without limits. This is more than a wording problem. Decision authority, the object of the decision, and its expiration were missing. A leader converts risk evidence and options into a choice that can be implemented and reviewed, and makes clear who has authority over each consequence.

**Accountability** does not mean one person performs every step. An identity team may revoke an account, security may lead evidence assessment, operations may decide whether to continue a service within a delegated limit, and a board may retain authority for risk appetite and escalation beyond that limit. A useful rights record distinguishes who recommends, who executes, who accepts residual risk, who must be informed, and who takes over when a decision owner is unavailable. A job title alone does not settle the matter when a service is shared between firms or a decision affects people's safety.

In NIST CSF 2.0, GV.RR addresses establishing, communicating, understanding, and enforcing cybersecurity responsibilities and authorities. GV.OV links risk-management results to adjustments of strategy. These are governance outcomes, not a compulsory RACI chart. Choose a representation decision makers can use, then test it under pressure. If a midnight service shutdown needs approval from someone no one can reach, delegation is broken even when the organization chart looks tidy.

## A decision record people can execute

Use a one-page record. First, state the objective and boundary: correct results to the correct patient, with a 60-minute business-hour interruption boundary. Second, list confirmed facts: a fix is available; estimated installation is 70–100 minutes; three attempts are unusual; an alternate route needs testing. Third, list what is unproven: exploitation, disclosure, actual installation time, and whether the fallback functions now. Fourth, give options: urgent patch; time-limited containment; or shutdown if disclosure evidence appears. Fifth, name the decision right: who may authorize crossing the outage boundary, who isolates administrative access, and who confirms the clinical fallback. Sixth, name success and reversal evidence: access logs, patch trial result, delivery of critical results, and next review time.

Separate **risk acceptance** from a **policy exception**. Residual-risk acceptance says the organization understands a named scenario after stated controls and an authorized person accepts it within a boundary and period. An exception temporarily permits a deviation from an established control, such as delaying a patch, with a compensating measure and expiration. They may coexist, but neither automatically justifies the other. Do not sign off on an exception without verifying the compensating control. “Extra monitoring” without an alert rule, owner, and review threshold is not testable protection.

Test delegation on paper before an emergency. Imagine the server fails at 02:00 and the product director is unreachable. Ask the on-call staff who may stop the portal, who contacts the clinical team, and who authorizes reopening after checks pass. If three people give different names, another signature will not repair the operating path. Specify a deputy and the boundary at which the decision moves upward. Do not give security authority to accept a clinical impact merely because it found the weakness. Do not block operations from urgent isolation within its delegated authority while a committee assembles. At shift handover, the next leader needs the last review time and the unresolved assumption, not only “stable.”

## A board message without decoration

The board does not need every technical log, but it needs the difference between fact, estimate, and choice. A concise message is: “A fix exists for our laboratory portal login component. We have no confirmed evidence of exploitation here; three unusual attempts remain unexplained. Installation may interrupt service for 70–100 minutes, above our 60-minute boundary. Today we will test the duration and critical-result fallback and restrict administrative access now. We seek authority for one of two paths within two hours. We will escalate immediately if disclosure appears or the fallback fails.” It invites a specific question and does not hide uncertainty behind a color.

After a decision, compare performance with the promise. If the exception is chosen, check at 24 hours whether the patch was installed or a new decision was made from newer evidence. If patching is chosen, measure actual interruption and confirm that critical results were not lost. If the laboratory contact chain failed to reach the on-call owner, fix that delegation path rather than merely editing the incident record. Oversight in GV.OV helps when it changes direction or execution, not when it only produces a report.

## Practice and answer criteria

A fictional learning service is about to run a live test for 12,000 learners. Security wants to disable an old plugin because an administrator privilege can export the email list. The testing team says disabling it may prevent necessary corrections for two hours. Only two administrator accounts exist. It may be possible to freeze export without disabling correction entry, but that freeze has not been tested. Assign decision rights, choose actions for the next four hours, and write a short escalation message.

A sound answer quickly tests export freezing in a comparable environment, narrows administrator privilege, and watches for export attempts. If the test works, freeze export and keep correction entry. If it fails, present disabling the plugin versus a narrowly bounded, time-limited exception to whoever may accept email-disclosure risk and test interruption consequences. Security alone cannot accept an impact on 12,000 learners; testing convenience is not permission to disclose their emails. The message states confirmed and unconfirmed facts, the decision deadline, the next reviewer, and a signal that ends the exception. Evidence of actual export would turn the matter into incident response rather than only a preventive exception.