Study Guide
Security Roles and Responsibilities
Who is responsible for security in an organisation: the CIO, the CISO or CSO and the ISSO, why everyone shares some of it, and the difference between due diligence and due care.
Lesson 5.15 Governance, Risk & Compliance
Security controls do not choose, fund or check themselves. People do, and in an organisation of any size it has to be clear which people. This lesson works out who is responsible for what, and two ideas that describe how that responsibility should be exercised.
Stage: Think
Locking up at night
Think it through
In a school, who is responsible for making sure the building is secure at night: the headteacher, the caretaker, or everyone? Explain.
- Hint 1: Who would the governors ask if the school were burgled?
Show what happens
In different ways, all of them: the headteacher answers for it and provides what is needed, the caretaker does the locking up, and everyone closes windows and reports a broken lock. Security in an organisation is shared out in the same way.
Think it through
Show the answer
Answer: B. Yes, still responsible.
Yes. She handed over the work, not the responsibility, so she still needs to know it is being done.
Stage: Explain
Who is responsible for security
The short answer is everyone, in different ways.
Overall responsibility sits at the top. Senior leaders decide the direction, provide the money and the people, and answer for the result. They hand the work to others. They cannot hand over the responsibility: Governance, Risk and Compliance explains why delegating a task does not remove oversight.
Responsibility for information security can be grouped under several headings. In the grouping used here, the CIO and the CSO sit under overall responsibility and the ISSO under technical. The other headings are Managerial, Non-technical, and Due care / liability.
| Heading | Who it usually means | What they are responsible for |
|---|---|---|
| Overall responsibility | Senior executives such as the CIO and the CSO or CISO | Direction, resources and answering for the outcome. |
| Managerial | Managers of departments and services | Making sure security is followed in their own area. |
| Technical | Specialist staff, such as an ISSO | Putting controls in place, maintaining them and monitoring them. |
| Non-technical | Everyone else | Following the policies and reporting concerns. |
| Due care / liability | Directors and owners above all, though everyone shares some part | Being answerable if reasonable steps were not taken. |
The second and third columns explain what headings like these usually mean.
Stage: Predict
CIO, CISO and CSO
Think it through
An organisation has one chief who leads its technology and another who leads its security. Why might it want both views in the room when deciding on a new system?
- Hint 1: What might each worry about?
Show what happens
One wants the technology delivered quickly and reliably; the other wants it delivered safely. A good decision needs both.
Three senior titles appear again and again. The letter C stands for “Chief”, meaning the most senior person for that subject.
| Role | Stands for | High-level focus | A question they ask |
|---|---|---|---|
| CIO | Chief Information Officer | Overall information-technology strategy and operations. | “Does our technology do what the organisation needs?” |
| CISO | Chief Information Security Officer | Information and cybersecurity strategy, governance, risk and protection. | “Are our information and systems protected well enough?” |
| CSO | Chief Security Officer | Security across the organisation. The remit may be broader than a CISO’s, and can include physical and corporate security as well as information security. | “Is the organisation as a whole secure: its people, its buildings and its information?” |
A short way to remember them: the CIO leads IT; the CISO or CSO leads security.
Check your understanding
Show the answer
Answer: C. CIO
The CIO, the Chief Information Officer.
The two jobs pull in slightly different directions, and that is healthy. A CIO wants technology delivered quickly and reliably. A CISO wants it delivered safely. An organisation needs both views in the room when it makes a decision.
Stage: Predict
The ISSO: security of particular systems
Think it through
ISSO stands for Information Systems Security Officer. Where a CISO looks across the whole organisation, an ISSO is system-focused: the role helps to ensure that particular information systems meet their security requirements, and that their controls, documentation, risks and remediation are managed properly.
For the system or systems they look after, an ISSO typically:
- checks that the required controls are in place and working;
- keeps the system’s security documentation up to date;
- tracks known weaknesses, and whether the fixes have been made;
- reports the system’s risks to more senior people.
A short way to remember the role: the ISSO oversees the security of information systems.
The title is most common in government and in large organisations. Elsewhere the same work may be done by someone called a system security manager or a security officer, or by the team that owns the system. NIST, the United States National Institute of Standards and Technology, uses the title in its guidance and describes the role as the individual responsible for maintaining the appropriate operational security posture for an information system or programme.
Stage: Predict
Titles vary between organisations
These descriptions are typical, not universal. In practice:
- a CISO may report to the CIO, to the chief executive or to a risk director;
- some organisations have a CISO and no CSO, some have a CSO and no CISO, and some use the two titles for the same job;
- in a small organisation one person may hold several of these roles, or a role may be bought in from an outside provider;
- the work of an ISSO may exist without anyone holding that title.
Think it through
In a new workplace the organisation chart shows titles you have not met before. What four questions would tell you more than the titles do?
- Hint 1: Think about deciding, approving, doing and checking.
Show what happens
Who decides, who approves, who does the work and who checks it.
A title does not tell you who decides, who approves, who does the work and who checks it. Those four questions are more reliable than any organisation chart, and they are worth asking in any new workplace.
Stage: Predict
Due diligence and due care
Think it through
Before a long walk in the hills, you check the weather forecast and the route; then you pack waterproofs and tell someone where you are going. What are the two different kinds of thing you did?
- Hint 1: Which actions gathered information, and which acted on it?
Show what happens
First you found out what could go wrong; then you did something sensible about it. Security has a name for each.
Two phrases describe how responsibility for security should be exercised. They are easy to confuse, and the difference is simple.
- Due diligence is investigating, assessing and understanding the risks. Memory aid: find out what could go wrong.
- Due care is taking reasonable action to address those risks. Memory aid: do something sensible about it.
An original diagram. Investigating and assessing lead to acting and protecting.
- Due diligence: investigate and assess
Find out what could go wrong. Look at the threats, the weaknesses and what is already in place.
- Due care: act and protect
Do something sensible about it. Take reasonable action to address the risks that were found.
An example: ransomware
Ransomware is malicious software that makes an organisation’s files unusable and demands payment to restore them.
| Due diligence: find out | Due care: act |
|---|---|
| Assess the threats. | Patch systems. |
| Inspect the vulnerabilities. | Improve the backups. |
| Review the backup arrangements. | Deploy multi-factor authentication. |
| Examine the current controls. | Train staff and put appropriate safeguards in place. |
The table lists the two kinds of activity. The fictional example that follows shows them happening in order, and who does each.
Check your understanding
Show the answer
Answer: A. Due care
Due care: patching is taking reasonable action on a risk that has been found.
A fictional school has a headteacher, a business manager who is responsible for the school’s systems and its security, and an IT technician who looks after particular systems day to day. In the terms of this lesson, the headteacher holds overall responsibility, the business manager plays the part a CISO or CSO plays in a larger organisation, and the technician the part of an ISSO.
- The question (overall responsibility). After a neighbouring school is hit by ransomware, the headteacher asks: “Could we carry on if that happened to us?” She does not need to know the answer. She needs to make sure somebody finds out.
- Due diligence: find out. The business manager asks the technician to check three things. The technician reports back in a week: the pupil-records system is backed up every night, nobody has ever tried restoring from a backup, and staff sign in to it from home with a password alone.
- Decide what is reasonable. The business manager now knows two specific weaknesses. She proposes two actions to the headteacher, with a cost for each: test a restore, and add multi-factor authentication for home sign-in. The headteacher approves both.
- Due care: act. The technician restores last night’s backup onto a spare computer. It takes four hours, and one folder turns out to have been missing from the backup all along. He fixes the backup to include it, then switches on multi-factor authentication for home sign-in.
- Record it. The business manager writes down what was checked, what was found, what was done and the result of the restore test, and puts a repeat test in the calendar for next term.
The result: the school now knows that it can recover in about four hours, and has closed the easiest way in. Six months later, if something does go wrong, it can show what it knew and what it did about it.
Take one half away. Had the business manager stopped after step 2, the school would have known that its backups were untested and done nothing: diligence without care. Had she skipped step 2 and simply bought a security product, the missing folder would never have been found: care without diligence.
Check your understanding
Show the answer
Answer: C. Diligence without care.
Diligence without care: it would have known its backups were untested and done nothing.
Why both are needed
- Diligence without care is knowing about a problem and doing nothing. An organisation that discovers its backups have never been tested, and leaves them untested, has investigated and has not acted.
- Care without diligence is acting without understanding. An organisation that buys security products without first finding out what its risks are may spend its effort in the wrong place.
“Reasonable” is the important word in due care. It means what a careful, sensible organisation would do in the circumstances. It does not mean removing every risk, which is impossible. Both activities are also continuous: new threats and new systems mean there is always more to find out and more to act on.
This connects to the Due care / liability heading in the table of responsibilities. If something goes wrong, an organisation may need to show that it understood its risks and took reasonable steps. Records of what was assessed and what was done are how it shows that. This lesson explains the ideas and is not legal advice: what counts as reasonable depends on the law and the circumstances.
The same pair appears elsewhere in this module. A gap analysis is a diligence activity, because it finds out where the organisation falls short. The remediation that follows is care.
In a support or administration role, due diligence and due care appear at a small scale every day. Checking what a change will affect before making it is diligence. Taking a backup first, making the change in a quiet period and telling the people affected is care.
Stage: Apply
Apply it in a new situation
These questions use the lesson in situations it has not shown. For the strongest test of your understanding, come back to them on another day and answer each one at the first attempt.
Apply it
Show the answer
Answer: B. Due diligence.
Due diligence: it acted without understanding its risks, so its effort may be in the wrong place.
Apply it
Show the answer
Answer: C. ISSO
An ISSO: the role oversees the security of particular information systems.
Apply it
Show the answer
Answer: B. Only reasonable action.
Due care means taking reasonable action in the circumstances, not removing every risk, which is impossible.
Stage: Check
Check your understanding
These questions come from the approved revision bank. Choose an answer and check it; the explanation and its sources follow.
Show answer
Answer: Chief Information Security Officer (CISO): information and cybersecurity strategy, governance, risk and protection
The Chief Information Security Officer (CISO) leads information and cybersecurity strategy, governance, risk and protection. The Chief Information Officer (CIO) leads overall information-technology strategy and operations, and the Information Systems Security Officer (ISSO) is the system-focused role that keeps one system’s controls and documentation in order. The Chief Security Officer (CSO) leads security and may have a broader remit; administering user accounts day to day is not that role.
Revision sources: Session 7: Security+ Session 1 — Security Concepts, Controls and Roles (Classroom session record) · Security Roles and Responsibilities (Supplementary Study Guide explanation)
Show answer
Answer: Information Systems Security Officer (ISSO)
The ISSO, the Information Systems Security Officer, is system-focused: the role helps to ensure that particular information systems meet their security requirements, and that their controls, documentation, risks and remediation are managed. That matches the description. A CISO or CSO looks across the whole organisation, and a CIO leads information technology as a whole.
Revision sources: Session 7: Security+ Session 1 — Security Concepts, Controls and Roles (Classroom session record) · Security Roles and Responsibilities (Supplementary Study Guide explanation)
Show answer
Answer: Titles and reporting lines vary, so ask who decides, approves and checks in each organisation.
Job titles and reporting lines are not identical across organisations. Roles may be combined, outsourced or named differently, so the description of each role is typical, not universal. Neither arrangement is wrong, a CISO who also looks after building security has not been given the wrong title, and two people with the same title can have different responsibilities. Relatedly, senior leaders, including a CIO or CISO where those roles exist, may lead implementation and governance, while top management keeps responsibility for leadership, resources and accountability. Asking who decides, who approves and who checks is more reliable than reading a title.
Revision sources: Session 4: Governance, Risk and Compliance — In Depth (Classroom session record) · Security Roles and Responsibilities (Supplementary Study Guide explanation)
Show answer
Answer: Due diligence is understanding the risks; due care is acting reasonably on them.
Due diligence is investigating, assessing and understanding the risks, and due care is taking reasonable action to address those risks. Due diligence comes first and due care acts on what it finds, because action should rest on an understanding of the risk. Swapping the two definitions is the commonest mistake. Neither term means reporting a breach, and the two are not separated by a date: both continue for as long as the organisation runs its systems.
Revision sources: Session 7: Security+ Session 1 — Security Concepts, Controls and Roles (Classroom session record) · Security Roles and Responsibilities (Supplementary Study Guide explanation)
Show answer
Answer: Patching its systems; Deploying multi-factor authentication; Training its staff
Ransomware makes the two ideas easy to separate. Patching systems, deploying multi-factor authentication and training staff are due care. Assessing the threats and reviewing the backup arrangements are due diligence. The line between them is that due diligence is investigating, assessing and understanding the risks, and due care is taking reasonable action to address them. Reviewing the backups finds out how things stand; improving them would be the action.
Revision sources: Security Roles and Responsibilities (Supplementary Study Guide explanation)
Show answer
Answer: Due diligence without due care
Diligence without care is knowing about a problem and doing nothing. Finding out that the backups are untested is due diligence: the company investigated and now understands a risk. Leaving them untested means that no reasonable action was taken, so due care is missing. The reverse failure, care without diligence, would be acting without first understanding the risks. Writing the finding down records the investigation; it does not address the risk.
Revision sources: Security Roles and Responsibilities (Supplementary Study Guide explanation)
Study and revision
Practise through the Governance & Policy revision topic. Questions cover which role fits a described responsibility, what makes an ISSO different from a CISO, why titles vary, and telling due diligence from due care; two flashcards recall the roles and the two memory aids. Items that use this lesson’s supplementary explanation say so. Most are learning-only. The questions that have been verified against CompTIA Security+ SY0-701 objective 5.4 are also in the Security+ practice track; that does not mean the lesson covers the whole of an objective, and the lesson does not establish practical experience.
Stage: Consolidate
What to remember
- Everyone has a part; senior leaders keep overall responsibility even when they hand over the work.
- The CIO leads IT; the CISO or CSO leads security, and a CSO’s remit may be broader.
- An ISSO is system-focused, overseeing the security of particular information systems.
- Titles vary; ask who decides, who approves, who does the work and who checks it.
- Due diligence is finding out; due care is taking reasonable action on what was found; both are needed, continuously.
Key terms
- CIO (Chief Information Officer)
The senior executive who typically leads an organisation’s information-technology strategy and operations.
- CISO (Chief Information Security Officer)
The senior executive who typically leads information and cybersecurity strategy, governance, risk and protection.
- CSO (Chief Security Officer)
A senior executive responsible for security across an organisation, whose remit may include physical and corporate security as well as information security.
- ISSO (Information Systems Security Officer)
The person responsible for the security of particular information systems: that their controls are in place and that their documentation, risks and remediation are managed.
- Due diligence
Investigating, assessing and understanding the risks.
- Due care
Taking reasonable action to address the risks that have been identified.
Common misunderstandings
Everyone has a part. Overall responsibility stays with senior leadership even when the work is delegated.
The CIO leads information technology. The CISO leads information security. The two overlap and are not the same.
Sometimes it is used that way. A CSO may also have a broader remit that includes physical and corporate security.
An ISSO is system-focused. Leading the whole programme is the job of a CISO or CSO.
Due diligence is finding out. Due care is acting on what was found.
It means taking reasonable action in the circumstances.
Further reading
Lesson sources and acknowledgements
Sources and scope
The school, its three members of staff and the restore test in the ransomware example are invented, and so are its figures. The mapping of a small school’s roles onto the CIO, CISO or CSO and ISSO is an illustration: small organisations combine these roles, as the lesson says.
- Taught in Session 4 (see the Session 4 Learning Log): senior leaders, including a CIO or CISO where those roles exist, may lead implementation and governance, while top management keeps responsibility for leadership, resources and accountability.
- Covered in Session 7 (see the Session 7 Learning Log): the roles slide, listing the CIO and CSO under overall responsibility and the ISSO under technical, with the further headings Managerial, Non-technical and Due care / liability; that there is a difference between due diligence and due care, which was explained; and the ISSO discussed as a role in exam-style scenario questions.
- Supplementary explanation: the description of each role and the question it asks, the explanation of the slide’s other headings, the detail of what an ISSO does and the NIST description, the note that titles vary, the definitions of due diligence and due care, the memory aids, the diagram, the ransomware table, why both diligence and care are needed, the link to gap analysis, the practical note and the misunderstandings. These were developed afterwards and are my explanations, not the tutor’s words. The diagram is original.
- Not recorded: what was said in Session 7 under the Managerial, Non-technical and Due care / liability headings.
- Guided version (published 1 November 2026, awaiting the site owner’s editorial review): the locking-up opening questions, every question asked in the lesson with its feedback and hints, the application questions and the closing summary are supplementary explanation written for the Study Guide. The settings are fictional. The questions in the lesson’s steps are not revision-bank items; those in “Check your understanding” are, unchanged.
- No practical work is claimed. I have not held any of these roles, and nothing here is legal advice.
The senior executive who typically leads an organisation’s information-technology strategy and operations.
The senior executive who typically leads information and cybersecurity strategy, governance, risk and protection.
A measure intended to modify risk, for example by restricting access, detecting misuse or supporting recovery.
A senior executive responsible for security across an organisation, whose remit may include physical and corporate security as well as information security.
Taking reasonable action to address the risks that have been identified.
Investigating, assessing and understanding the risks.
The direction, accountability and oversight through which an organisation sets and checks its security decisions.
Protecting information by bringing together policies, processes and technical controls throughout the information’s lifecycle.
The person responsible for the security of particular information systems: that their controls are in place and that their documentation, risks and remediation are managed.
Authentication that requires two or more different types of factor, such as something you know and something you have.
The principle that a person should access particular information only where their role gives a legitimate requirement for it.
Applying updates from a software vendor that fix known vulnerabilities or other flaws.
A document that sets organisational rules and expectations, defining what is and is not permitted.
Malicious software that denies access to systems or data, typically by encrypting them, in order to extort payment. Some incidents also involve data theft.
Uncertainty and potential harm to an organisation’s objectives, considering what could happen, how likely it is, the consequences and the organisation’s context.
A device that connects devices within a local network and forwards Ethernet frames using the MAC addresses it has learned.
A potential cause of harm, such as an attacker seeking unauthorised access.
A weakness that a threat may exploit.
Your progress on this lesson
Saved in this browser only. It is not sent anywhere, does not follow you to another device, and is lost if you clear this site’s data.
This browser is not allowing the site to save progress, so it will be forgotten when you leave the page.