What it asks for. This category asks organisations to establish and communicate cybersecurity roles, responsibilities and authorities so that accountability, performance assessment and continuous improvement are possible. Leadership takes responsibility for cybersecurity risk and fosters a risk-aware culture.
In practice. Senior leadership formally owns cybersecurity risk, and roles are defined across the business, IT, security, legal and procurement, typically through a RACI model. Adequate resources are allocated in line with the risk strategy, and cybersecurity is built into human resources processes such as hiring, onboarding and role changes. Evidence includes board or executive minutes, documented role descriptions, a named accountable executive, budget decisions and records showing security responsibilities in job descriptions.
Common gaps. A frequent gap is cybersecurity being treated as an IT function with no business ownership of risk. Responsibilities for suppliers, cloud services and incident decisions are often unclear, and resourcing is not linked to the risk picture.