Organizational Structure

The development of a security strategy is highly influenced by the organizational structure. Organizational structure pertains to the roles and responsibilities of different individuals, the reporting hierarchy, whether the organization functions in a centralized or decentralized way, and so on. A flexible and evolving organizational structure is more open to the adoption of a security strategy, whereas an organization with a more constrained structure might not adopt a security strategy.

The independence of the security function is the most important factor to be considered, from a practical as well as the exam perspective, while evaluating organizational functions. This can be assessed through the reporting structure of the security function.

Board of Directors

The ultimate responsibility for the appropriate protection of an organization's information falls on the board of directors. The involvement of board members in information security initiatives can be an indicator of good governance. In the event of an incident, the company directors can be protected from liability if the board has exercised due diligence. Many laws and regulations make the board responsible in the event of data breaches. Even cyber security insurance policies require the board to exercise due diligence as a prerequisite for insurance coverage.

Security Steering Committee

The security steering committee is generally composed of senior management from different business units. The security steering committee is best placed to determine the level of acceptable risk (risk capacity) for the organization. They monitor and control the security strategy. They also ensure that the security policy is aligned with the business objectives.

Reporting of Security Functions

In the past, security functions in most organizations reported to the chief information officer (CIO). However, it has since been observed that CIOs are primarily concerned with IT performance and cost, with security as a secondary objective. During a conflict between performance and security, security is sometimes ignored.

However, with increased awareness and more experience, the responsibility for security is now entrusted to senior-level functionaries directly reporting to the chief operating officer (COO), chief executive officer (CEO), or board of directors. This ensures the independence of security functions.

Organizations' security functions can work in either a centralized or decentralized way.

Centralized vis-à-vis Decentralized Security Functioning

In a centralized process, information security activities are handled from a central location, usually the head office of the organization. In a decentralized process, the implementation and monitoring of security activities are delegated to the local offices of the organization.

The following table shows the differentiation between centralized and decentralized processes:

Centralized Process	Decentralized Process
More consistency in security processes	Less consistency
Optimum utilization of information security resources	Greater resource requirements. Better alignment with decentralized unit requirements
Less alignment with the requirements of decentralized units	Better alignment with decentralized unit requirements
A centralized process will generally take more time to process requests due to the larger gap between the information security department and the end user	Faster turnaround of requests compared to centralized processes

Figure 1.7: Differences between centralized and decentralized processes

Centralization of information security management results in greater uniformity and easier monitoring of processes. This in turn promotes better adherence to security policies.

Practice Question Set 5

1. Which of the following is a characteristic of a centralized information security management process?
   1. Processes are costlier to manage compared to decentralized processes
   2. Better adherence to policy compared to decentralized processes
   3. Better alignment with business unit requirements compared to decentralized processes
   4. Faster turnaround of requests compared to decentralized processes
2. Who should determine the acceptable level of information security risk?
   1. Legal department
   2. CISO
   3. Audit department
   4. Steering committee
3. As an information security manager, how do you characterize a decentralized information security process?
   1. Consistency in information security processes
   2. Better compliance with policy
   3. Better alignment with decentralized unit requirements
   4. Optimum utilization of information security resources

Information Security Roles and Responsibilities

It is very important to ensure that security-related roles and responsibilities are clearly defined, documented, and communicated throughout the organization. Each employee of the organization should be aware of their respective roles and responsibilities. Clearly defined roles also facilitate effective access rights management, as access is provided based on the respective job functions and job profiles of employees – that is, on a need-to-know basis (least privilege) only.

RACI Chart

One of the simplest ways to define roles and responsibilities in a business or organization is to form a matrix known as a RACI chart. This stands for responsible, accountable, consulted, and informed.

This chart indicates who is responsible for a particular function, who is accountable with regard to the function, who should be consulted about the function, and who should be informed about the function. Clearly defined RACI charts make the information security program more effective.

The following defines RACI in more detail:

• Responsible: This is the person who is required to execute a particular job function.
• Accountable: This is the person who is required to supervise a job function.
• Consulted: This is the person who gives suggestions and recommendations for executing a job function.
• Informed: This is the person who should be kept updated about the progress of the job function.

In the next section, you will go through the various roles that are integral to information security.

Board of Directors

The role of board members in information security is of utmost importance. Board members need to be aware of security-related key risk indicators (KRIs) that can impact the business objectives. The intent and objectives of information security governance must be communicated from the board level down.

The current status of key security risks should be tabled and discussed at board meetings. This helps the board to determine the effectiveness of the current security governance.

Another essential reason for the board of directors to be involved in security governance is liability. Most organizations obtain specific insurance to deal with their financial liability in the event of a security incident. This type of insurance requires those bound by it to exercise due care in the discharge of their duties. Any negligence from the board in addressing the information security risk may make the insurance void.

Senior Management

The role of senior management is to ensure that the intent and requirements of the board are implemented in an effective and efficient manner. Senior management is required to provide ongoing support to information security projects in terms of budgets, resources, and other infrastructure. In some instances, there may be disagreement between IT and security. In such cases, senior management can take a balanced view after considering performance, cost, and security. The role of senior management is to map and align the security objectives with the overall business objectives.

Business Process Owners

The role of a business process owner is to take ownership of the security-related risks impacting their business processes. They need to ensure that information security activities are aligned and support their respective business objectives. Further, they need to monitor the effectiveness of security measures on an ongoing basis.

Steering Committee

A steering committee comprises the senior management of an organization. The role of a steering committee is as follows:

• To ensure that security programs support the business objectives
• To evaluate and prioritize the security programs
• To evaluate emerging risks, security practices, and compliance-related issues

The roles, responsibilities, and scope of a steering committee should be clearly defined.

Chief Information Security Officer

The chief information security officer (CISO) is a senior-level officer who has been entrusted with making security-related decisions and is responsible for implementing security programs. The CISO should be an executive-level officer directly reporting to the CEO. The role of the CISO is fundamentally regulatory, whereas the role of the CIO is to generally focus on IT performance.

Chief Operating Officer

The COO is the head of operational activities in the organization. Operational processes are reviewed and approved by the COO. The COO has a thorough knowledge of the business operations and objectives and is most likely the sponsor for the implementation of security projects as they have a strong influence across the organization. Sponsoring means supporting the project financially or through products or services. Although the CISO should provide security advice and recommendations, the sponsor should be the COO for effective ground-level implementation.

Data Custodian

The data custodian is a staff member who is entrusted with the safe custody of data. The data custodian is different from the data owner, though in some cases, both data custodian and data owner may be the same individual. A data custodian is responsible for managing the data on behalf of the data owner in terms of data backup, ensuring data integrity, and providing access to data for different individuals on the basis of the approval of the data owner. From a security perspective, a data custodian is responsible for ensuring that appropriate security measures are implemented and are consistent with organizational policy.

Communication Channel

A well-defined communication channel is of utmost importance in the management of information security. A mature organization has dedicated systems to manage risk-related communication. This should be a two-way system, wherein management can reach all employees and at the same time employees can reach a designated risk official to report identified risks. This will help in the timely reporting of events, as well as disseminating important security information. In the absence of an appropriate communication channel, the identification of events may be delayed.

Indicators of a Security Culture

The following list consists of some of the indicators of a successful security culture:

• The involvement of the information security department in business projects
• End users are aware of the identification and reporting of incidents
• There is an appropriate budget for information security programs
• Employees are aware of their roles and responsibilities regarding information security

Understanding the roles and responsibilities as covered in this section will help the security manager to implement an effective security strategy.

Key Aspects from the CISM Exam Perspective

The following are some key aspects from the exam perspective:

Question	Possible Answer
What is the best course of action when there is disagreement on the security aspects between the IT team and the security team?	To refer the matter to senior management along with any necessary recommendations
What is the immediate benefit of well-defined roles and responsibilities?	Better accountability
Who has the ultimate responsibility for legal and regulatory requirements?	The board of directors and the senior management (when the board delegates them the responsibility)
What is the best way to prioritize information security projects?	Security projects should be assessed and prioritized based on their impact on the organization
Who has the responsibility to enforce the access rights of employees?	The data custodian/security administrators
What is the most important factor on which the data retention policy is based?	The business requirements
What is the prime responsibility of an information security manager?	To manage the risks to information assets
Which models are used to determine the extent and level of maturity of processes?	The maturity model The process performance and capability model
What is the major concern if database administrators (DBAs) have access to DBA-related logs?	The unauthorized modification of logs by the DBA
What is the main objective of integrating security-related roles and responsibilities?	To address security gaps that exist between assurance functions
What is the role of the information owner with regard to the data classification policy?	To determine the level of classification for their respective data
What is the role of the information security manager with regard to the data classification policy?	To define and ratify the data classification process
What is the best way to ensure that responsibilities are carried out?	Assign accountability
Who is responsible for complying with the organization's security policies and standards?	All organizational units Every employee
What is the principle of proportionality for providing system and data access?	The principle of proportionality requires that access be proportionate to the criticality of the assets and access should be provided on a need-to-know basis
What is the segregation of duties?	Segregation of duties (SoD) is a control wherein a critical function or job is divided into two parts and each part is handled by a separate individual The objective of SoD is to prevent error and fraud
What is a compensatory control?	Compensatory controls are controls that are placed in lieu of main controls as main controls are difficult to implement. The objective of compensatory controls is to address the risk until the main controls are implemented. Compensatory controls are also referred to as alternative controls.
What is the principle of least privilege?	The principle of least privilege ensures that access is provided only on a need-to-know basis, and it should be restricted for all other users

Figure 1.8: Key aspects from the CISM exam perspective

Practice Question Set 6

1. The information security team is mapping job descriptions to relevant data access rights. This is based on:
   1. The principle of accountability
   2. The principle of proportionality
   3. The principle of integration
   4. The principle of the code of ethics
2. As an information security manager, you are reviewing the function of the data custodian. The data custodian is primarily responsible for:
   1. Approving access to the data
   2. The classification of assets
   3. Enhancing the value of data
   4. Ensuring all security measures are in accordance with the organizational policy
3. You are an information security manager for a bank. One of your critical recommendations is not accepted by the IT head. What should your next course of action be?
   1. Refer the matter to an external third party for resolution
   2. Request senior management to discontinue the relevant project immediately
   3. Ask the IT team to accept the risk
   4. Refer the matter to senior management along with any necessary recommendations
4. As an information security manager, you strongly recommend having well-defined roles and responsibilities from an information security perspective. The most important reason for this recommendation is:
   1. Adherence to security policies throughout the organization
   2. Well-structured process flows
   3. The implementation of SoD
   4. Better accountability
5. What is the prime role of an information security manager in a data classification process?
   1. To define and ratify the data classification process
   2. To map all data to different classification levels
   3. To provide data security, as per the classification
   4. To confirm that data is properly classified
6. Which of the following is the area of most concern for the information security manager?
   1. That there are vacant positions in the information security department
   2. That the information security policy is approved by senior management
   3. That the steering committee only meets on a quarterly basis
   4. That security projects are reviewed and approved by the data center manager
7. An information security manager should have a thorough understanding of business operations with the prime objective of which of the following?
   1. Supporting organizational objectives
   2. Ensuring regulatory compliance
   3. Concentrating on high-risk areas
   4. Evaluating business threats
8. In a big multi-national organization, the best approach to identify security events is to do which of the following?
   1. Conduct frequent audits of the business processes
   2. Deploy a firewall and intrusion detection system
   3. Develop communication channels across the organization
   4. Conduct vulnerability assessments of new systems
9. Legal and regulatory liability is the responsibility of which of the following?
   1. The chief information security officer
   2. The head of legal
   3. The board of directors and senior management
   4. The steering committee
10. What is the best way to gain support from senior management for information security projects?
    1. Lower the information security budget
    2. Conduct a risk assessment
    3. Highlight industry best practices
    4. Design an information security policy
11. Prioritization of information security projects is best conducted based on which of the following?
    1. The turnaround time of the project
    2. The impact on the organization's objectives
    3. The budget of the security project
    4. The resource requirements for the project
12. Who is responsible for enforcing the access rights of employees?
    1. The process owner
    2. The data owner
    3. The steering committee
    4. The security administrators
13. Who is responsible for information classification?
    1. The data administrator
    2. The information security manager
    3. The information system auditor
    4. The data owner
14. What is the data retention policy primarily based on?
    1. Indus\try practices
    2. Business requirements
    3. Regulatory requirements
    4. Storage requirements
15. What is the most important security aspect for a multi-national organization?
    1. The local security program should comply with the corporate data privacy policy
    2. The local security program should comply with the data privacy policy of the location where the data is collected
    3. The local security program should comply with the data privacy policy of the country where the headquarters are located
    4. The local security program should comply with industry best practices
16. The ultimate accountability for the protection of sensitive data lies with which of the following?
    1. The security administrators
    2. The steering committee
    3. The board of directors
    4. The security manager
17. The most likely authority to sponsor the implementation of new security infrastructure for business processes is which of the following?
    1. The CISO
    2. The COO
    3. The head of legal
    4. The data protection officer
18. Who should determine the requirements for access to data?
    1. The security officer
    2. The data protection officer
    3. The compliance officer
    4. The business owner
19. The responsibility for establishing information security controls in an application resides with which of the following?
    1. The information security steering committee
    2. The data owner
    3. The system auditor
    4. The system owner