I am talking about the reality that someone must be responsible so we can hold their feet to the fire. We don’t want to get to the point of too many directions of responsibility, as then when a breach does happen it is dangerous to see what will happen from there? So the CISA (Certified Information Systems Auditor) exam prep says that the Board of the company is responsible as they are the stakeholders. The board ultimately controls the purse strings, and hiring/firing of the CEO. But the problem with Cybersecurity is the changing nature of threats with increasing use of technology. Thus if the CEO changed some parameters unknown to the board, or if the board has not had time to digest then the CEO should be part responsible as well.
So if the CEO is part responsible because of changes that are occurring without the board’s knowledge… or is it that the board should have contingency plans for unknown changes?
Let’s review what responsibility means?
The state or fact of having a duty to deal with something or of having control over someone.
The state of fact of being accountable for something
The opportunity or ability to act independently and make decisions without authorization
I want to restate this dictionary definition for cybersecurity specifically:
The ISACA Auditing standard will stay as the “Financially” responsible entity will stay in the board.
But I want to pick into who is responsible for Cybersecurity? Is it the person who misuses one of the definitions:
“The opportunity or ability to act independently and make decisions without authorization”
We all use computers (and mobile devices) independently, and in fact more devices are coming into our lives that will create problems if we do not use them properly.
So even though the board is financially responsible, we are all responsible for using our devices with a certain amount of Cybersecurity intelligence.
The board has to set the stage with enough funding for firewalls, and audits and the like, but the users are responsible for using the devices without clicking on phishing emails or going to questionable websites that will cause problems even in the most secure environments.
Contact Us to create a security policy for the future.