Defining Responsibilities
Defining Responsibilities in a Security Policy
A security policy must define responsibilities clearly across the whole organisation. This covers three key aspects: establishing who owns which security tasks, giving staff a clear route to report concerns, and ensuring that security information reaches every employee effectively.
Who is responsible for what
A security policy must clearly state which individuals or teams own specific security tasks — otherwise, things get missed simply because everyone assumes someone else is handling them.
For example, the IT department might be responsible for installing software updates and managing firewalls, whilst line managers are responsible for ensuring their team members complete security training. Individual employees are typically responsible for keeping their passwords confidential and locking their screens when away from their desks.
Without this clarity, accountability disappears and vulnerabilities go unaddressed.
Unlock All Revision Notes
Syllabus-perfect, clutter-free summaries — so you only study what really matters.
Start your 7-day free trial (no card needed!)Existing User? Sign In