Lesson 4.45: Security roles and RACI
Security fails at the seams between teams: the task everyone assumed someone else owned, the decision two people think is theirs. A RACI matrix makes ownership explicit: for every activity, who is Responsible for doing it, who is Accountable (exactly one), who is Consulted and who is Informed. Where the CISO reports matters too: a CISO who reports to the CIO has to escalate problems in the CIO's own systems to the CIO. In the lab you check Northwind's RACI for gaps and conflicts, look at the reporting lines and write the fixes.
17 min
You will learn to
- Explain R, A, C and I
- Find activities with no or several accountable owners
- Find activities nobody performs
- Judge reporting lines for independence
- Write ownership fixes
Key terms
- RACI
- Responsible (does it), Accountable (answers for it, exactly one), Consulted (asked before), Informed (told after).
- CISO
- Chief information security officer: leads the security programme.
- DPO
- Data protection officer under GDPR, independent in their tasks (Articles 37-39).
- Three lines model
- IIA model: management owns risk (1st line), risk and compliance functions oversee (2nd), internal audit gives independent assurance (3rd).
- Segregation of duties
- Not letting one person both do and approve (or check) the same thing.
← Running phishing simulations ethically · All lessons · Executive crisis simulation →