- Introduction
- Basic Security Principles
- Data Management: Determining and Maintaining Ownership
- Data Governance Policies
- Roles and Responsibilities
- Data Ownership
- Data Custodians
- Data Documentation and Organization
- Data Warehousing
- Data Mining
- Knowledge Management
- Data Standards
- Data Lifecycle Control
- Data Audits
- Data Storage and Archiving
- Data Security, Protection, Sharing, and Dissemination
- Privacy Impact Assessment
- Information Handling Requirements
- Record Retention and Destruction
- Data Remanence and Decommissioning
- Classifying Information and Supporting Asset Classification
This chapter is from the book
This chapter is from the book
This chapter is from the book
Roles and Responsibilities
Data security requires responsibility. A clear division of roles and responsibility is a tremendous help when dealing with any security issues. Everyone should be subject to the organization’s security policy, including employees, management, consultants, and vendors. Specific roles have unique requirements. Some key players and their responsibilities are as follows:
Data owner: Because senior management is ultimately responsible for data and can be held liable if it is compromised, the data owner is usually a member of senior management or the head of that department. The data owner is responsible for setting the security classification of the data. The data owner can delegate some day-to-day responsibility.- Data custodian: The data custodian, who is usually a member of the IT department, does not decide what controls are needed but implements controls on behalf of the data owner. Other responsibilities include handling the day-to-day management of data, controlling access, adding and removing privileges for individual users, and ensuring that the proper controls have been implemented.
- Information security steering committee: Individuals on this committee are from various levels of management and represent the various departments of the organization. They meet to discuss and make recommendations on security issues.
- Senior management: These individuals are ultimately responsible for the security practices of the organization. Senior management might delegate day-to-day responsibility to another party or someone else but cannot delegate overall responsibility for the security of the organization’s data.
- Security advisory group: These individuals are responsible for reviewing security issues with the chief security officer and are also responsible for reviewing security plans and procedures.
- Chief security officer: This individual is responsible for the day-to-day security of the organization and its critical assets.
- Users: End users in an organization have responsibilities: They must comply with the requirements laid out in policies and procedures.
- Developers: These individuals develop code and applications for the organization. They are responsible for implementing the proper security controls within the programs they develop.
- Auditor: This individual is responsible for examining the organization’s security procedures and mechanisms. The auditor must provide an independent and objective opinion about the effectiveness of the organization’s security controls. How often this process is performed depends on the industry and its related regulations. For example, the healthcare industry in the United States is governed by Health Insurance Portability and Accountability Act (HIPAA) regulations and requires yearly reviews.