Security Roles and Responsibilities

Lesson plan

Level

Beginner

Time

About 50 minutes; the steps below add up to 49

Learners decide who is responsible for locking up a school at night, and whether delegating the job hands over responsibility, before the headings of responsibility are named. Predictions then precede why both technology and security chiefs are needed, who looks after one system, the four questions behind any title and the two kinds of preparation for a hill walk; checks follow the CIO, patching and the school stopping half way. The habit to build: separate the work from the responsibility, and finding out from acting.

Objectives

• Explain how responsibility for security is shared across an organisation
• Describe the CIO, CISO and CSO and how they differ
• Describe the ISSO as a system-focused role
• Explain why titles vary, and the questions that matter more
• Distinguish due diligence from due care, and why both are needed

Before the lesson

• Open this page on your own screen and use “Open the lesson window” to open the lesson in a second window. Share only that second window.
• Learners need the GRC and Risk lessons first.
• Write “find out” and “act” as two column headings for the due diligence and due care step.
• The lesson takes about 49 minutes.
• In presentation mode every step is shown in turns: Next reveals one moment, part or answer at a time, and the instructor view names what is on screen and what comes next.

Steps

1. Introduction Opening

   On screen: the lesson’s title, module and number; Next adds its objectives and key terms, as the lesson page lists them; Next again begins the first step.

   Objectives on screen

   • Explain how responsibility for security is shared across an organisation
   • Describe the CIO, CISO and CSO and how they differ
   • Describe the ISSO as a system-focused role
   • Explain why titles vary, and the questions that matter more
   • Distinguish due diligence from due care, and why both are needed

   Purpose: Learners decide who is responsible for locking up a school at night, and whether delegating the job hands over responsibility, before the headings of responsibility are named. Predictions then precede why both technology and security chiefs are needed, who looks after one system, the four questions behind any title and the two kinds of preparation for a hill walk; checks follow the CIO, patching and the school stopping half way. The habit to build: separate the work from the responsibility, and finding out from acting.

2. 1. Locking up at night Think 5 min

   Purpose: Raise shared and delegated responsibility with a school at night.

   Ask

   • Whose job is it?
   • Is the headteacher still responsible?

   Responses to expect

   • “The caretaker” is the first answer; “everyone” follows with a prompt.
   • On screen in turns: the opening question, its answer; then the question on handing the job over, and its answer.

   Discussion pause: Let learners argue it out before revealing.

   In the lesson window

   • Think it through: In a school, who is responsible for making sure the building is secure at night: the headteacher, the caretaker, or everyone? Explain.
   • Think it through: The headteacher asks the caretaker to lock up. Is the headteacher still responsible if the school is burgled?

3. 2. Who is responsible for security Explain 5 min

   Purpose: Show how responsibility is grouped across an organisation.

   Ask

   • Which heading covers everyone else?

   Responses to expect

   • Non-technical.
   • On screen in turns: the opening; then overall responsibility sits at the top; five headings, with responsibilities held back; what each is responsible for; what the columns explain.

   Misconceptions to challenge

   • A learner may believe: “The CISO is responsible for security, so nobody else is.” Respond: Everyone has a part; overall responsibility stays at the top.

   Discussion pause: The responsibilities column is held back: ask what each heading would be responsible for before revealing it.

4. 3. CIO, CISO and CSO Predict 6 min

   Purpose: Distinguish the CIO, CISO and CSO.

   Ask

   • Why both views?
   • Which role leads IT?

   Responses to expect

   • CIO and CISO are often merged.
   • On screen in turns: the opening question, its answer; then three senior titles, with the question each asks held back; the question each asks; a short way to remember them; the check question on who leads IT, and its answer; two jobs pulling in different directions.

   Misconceptions to challenge

   • A learner may believe: “The CIO and the CISO do the same job.” Respond: One leads IT, the other security.
   • A learner may believe: “CSO is just another name for CISO.” Respond: Sometimes; a CSO may have a broader remit.

   In the lesson window

   • Think it through: An organisation has one chief who leads its technology and another who leads its security. Why might it want both views in the room when deciding on a new system?
   • Check your understanding: Which role leads overall information-technology strategy and operations?

5. 4. The ISSO: security of particular systems Predict 4 min

   Purpose: Describe the ISSO as a system-focused role.

   Ask

   • Who looks after one system?

   Responses to expect

   • Many say the CISO.
   • On screen in turns: the opening question, its answer; then the ISSO: system-focused; what an ISSO does, starting with controls; documentation; known weaknesses; reporting risks; a short way to remember the role; where the title is used.

   Misconceptions to challenge

   • A learner may believe: “An ISSO runs the organisation’s security programme.” Respond: The role looks after particular systems.

   In the lesson window

   • Think it through: A large organisation runs dozens of systems. Who might look after the security of one particular system, day to day?

6. 5. Titles vary between organisations Predict 3 min

   Purpose: Show that titles vary, and the four questions that matter more.

   Ask

   • What four questions would you ask?

   Responses to expect

   • Decide, approve, do, check.
   • On screen in turns: the opening; then the question on four better questions, and its answer; titles do not say who decides.

   In the lesson window

   • Think it through: In a new workplace the organisation chart shows titles you have not met before. What four questions would tell you more than the titles do?

7. 6. Due diligence and due care Predict 13 min

   Purpose: Distinguish due diligence from due care, through the ransomware example, and why both are needed.

   Ask

   • What two kinds of preparation did you do?
   • Is patching diligence or care?
   • What if What if the manager stopped at step 2?

   Responses to expect

   • The two are easily swapped.
   • On screen in turns: the opening question, its answer; then two phrases, starting with due diligence; due care; due diligence first, then due care; ransomware: finding out, with the actions held back; the matching actions; the check question on patching, and its answer; could the school survive ransomware, starting with the question; due diligence; deciding what is reasonable; due care; recording it; the result; taking one half away; the check question on stopping after step 2, and its answer; why both are needed, starting with diligence without care; care without diligence; what “reasonable” means; due care and liability; the same pair elsewhere in the module; diligence and care at a small scale.

   Misconceptions to challenge

   • A learner may believe: “Due diligence and due care mean the same thing.” Respond: One is finding out; the other is acting.
   • A learner may believe: “Due care means removing every risk.” Respond: It means reasonable action.

   Discussion pause: The actions column of the ransomware table is held back: for each finding-out activity, ask what the matching action would be. Then reveal the school’s story one step at a time.

   If the explanation does not land: Use buying a used car: checking its history is diligence; servicing it is care.

   To go further

   • Which records would let the school show, six months later, that it exercised both?

   In the lesson window

   • Think it through: Before a long walk in the hills, you check the weather forecast and the route; then you pack waterproofs and tell someone where you are going. What are the two different kinds of thing you did?
   • Check your understanding: Patching systems against ransomware: due diligence or due care?
   • Check your understanding: If the business manager had stopped after step 2, what would the school have had?

8. 7. Apply it in a new situation Apply 4 min

   Purpose: Set up independent application, ideally on a later day.

   Ask

   • Who will try these now, and who later in the week?

   Responses to expect

   • The product tests diligence; the payroll system tests the ISSO; the director tests “reasonable”.
   • On screen in turns: the opening; then the question on buying a product first, and its answer; the question on the payroll system’s officer, and its answer; the question on removing every risk, and its answer.

   In the lesson window

   • Apply it: A company buys an expensive security product without first finding out what its risks are. What is missing?
   • Apply it: Someone keeps one payroll system’s security documentation current and tracks its unfixed weaknesses. Which role is that most like?
   • Apply it: A director says, “Due care means we must remove every risk.” What is the best reply?

9. 8. Check your understanding Check 6 min

   Purpose: Check the lesson against the approved revision-bank questions.

   Ask

   • Answer individually, then compare before revealing.

   Responses to expect

   • The role questions link to the CIO and ISSO steps.
   • On screen in turns: the opening; then the revision questions one at a time, each followed by its answer; where to practise next.

10. 9. What to remember Consolidate 3 min

    Purpose: Summarise the five points, the key terms and the misunderstandings.

    Ask

    • Without looking: the two memory aids for diligence and care.

    Responses to expect

    • Find out what could go wrong; do something sensible about it.
    • On screen in turns: the opening; then the summary; the key terms; the common misunderstandings.

11. Lesson recap Closing

    On screen: the lesson’s objectives again; Next adds the closing question, which asks the class to explain each one in their own words without looking back. It says nothing about what anyone has learnt: use the answers to decide what to revisit.

    Points to listen for

    • The work can be handed over; the responsibility cannot.
    • IT and security, side by side.
    • Some roles look after one system.
    • Ask who decides, approves, does and checks.
    • Find out, then act.

Consolidation

• The work can be handed over; the responsibility cannot.
• IT and security, side by side.
• Some roles look after one system.
• Ask who decides, approves, does and checks.
• Find out, then act.