Roles and Responsibilities
What is Roles and Responsibilities?
Clear definitions of what each position or team is expected to do, their authority levels, and their accountability relationships within an organization.
Terms that appear alongside roles and responsibilities
Each of these is named in at least one of the same controls as roles and responsibilities. The number is how many controls name both.
- information security 31 shared controls
- governance 29 shared controls
- policy 13 shared controls
- nist 9 shared controls
- security governance 8 shared controls
- security officer 8 shared controls
- compliance 7 shared controls
- incident response 7 shared controls
Frameworks that govern roles and responsibilities
What the standards actually require on roles and responsibilities
Requirements naming roles and responsibilities across 6 standards, quoted from the control text.
The enterprise defines who is responsible for what in enterprise I&T and communicates it, covering levels of authority, responsibilities and accountability.
cobit-2019::APO01.05 · APO01.05 Establish roles and responsibilities →Responsibilities for the Requirement 2 activities (building and maintaining configuration standards, handling vendor defaults, disabling unneeded functions, securing wireless) must be written down, allocated, and understood by those who hold them.
2.1.2 · 2.1.2 Requirement 2 roles and responsibilities assigned →Roles and responsibilities for detection are well defined to ensure accountability. DETECT (DE) Function, Detection Processes (DE.DP) Category. Outcome in the Framework Core of Version 1.0; unchanged in Version 1.1.
nist-cybersecurity-framework-1-0::DE.DP-1 · DE.DP-1: Roles and responsibilities for detection are well defined to ensure accountability →Privileged users understand their roles and responsibilities. PROTECT (PR) Function, Awareness and Training (PR.AT) Category. Outcome in the Framework Core of Version 1.1; carried into CSF 2.0 as PR.AT-02.
nist-cybersecurity-framework-1-1::PR.AT-2 · PR.AT-2: Privileged users understand their roles and responsibilities →The plan must require that who does what in the monitoring program's detection processes and procedures is defined, updated for organisational or environmental change, and communicated to stakeholders.
api-1164::DE.DP-1 · DE.DP-1 Detection roles and responsibilities defined, updated and communicated →Information security roles and responsibilities are to be set out and assigned to people in a way that fits what the organization needs.
iso-27002-2022::5.2 · Information security roles and responsibilities →Questions people ask about roles and responsibilities
What is Roles and Responsibilities?
Why is Roles and Responsibilities important for compliance?
Which compliance frameworks address Roles and Responsibilities?
Where can I learn more about Roles and Responsibilities?
See how Roles and Responsibilities applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.