Title: Security Professionals and the Organization
Course: IN 2001 Principle of Information Assurance > Section: Module 1: Chapter One

Security Professionals and the Organization

It takes a wide range of professionals to support a diverse information security program.

To develop and execute specific security policies and procedures, additional administrative support and technical expertise is required.

Senior Management

Chief Information Officer: The senior technology officer, although other titles such as vice president of information, VP of information technology and VP of systems may also be used.  The CIO is primarily responsible for advising the chief executive officer, president or company owner on the strategic planning that affects the management of information in the organization.

Chief Information Security Officer: The individual primarily responsible for the assessment, management and implementation of securing the information in the organization.  The CISO may also be referred to as the manager for security, the security administrator or a similar title.

Information Security Project Team

The security project team consists of a number of individuals who are experienced in one or multiple facets of the required technical and nontechnical areas.

Champion: A senior executive who promotes the project and ensures its support, both financially and administratively, at the highest levels of the organization.

Team leader: A project manager, who may be a departmental line manager or staff unit manager, who understands project management, personnel management and information security technical requirements.

Security policy developers: Individuals who understand the organizational culture, policies and requirements for developing and implementing successful policies.

Risk assessment specialists: Individuals who understand financial risk assessment techniques, the value of organizational assets and the security methods to be used.

Security professionals: Dedicated, trained and well-educated specialists in all aspects of information security from both a technical and nontechnical standpoint.

Systems administrators: Individuals whose primary responsibility is administering the systems that house the information used by the organization.

End users: Those whom the new system will most directly impact.  Ideally, a selection of users from various departments, levels and degrees of technical knowledge assist the team in focusing on the application of realistic controls applied in ways that do not disrupt the essential business activities they seek to safeguard.

Data Responsibilities

Now that you understand the responsibilities of both senior management and the security project team, we can define the roles of those who own and safeguard the data.

Data Owners: Those responsible for the security and use of a particular set of information.  Data owners usually determine the level of data classification associated with the data, as well as changes to that classification required by organizational change.

Custodians: Those responsible for the storage, maintenance and protection of the information.  The duties of a data custodian often include overseeing data storage and backups, implementing the specific procedures and policies laid out in the security policies and plans and reporting to the data owner.

Data Users: End users who work with the information to perform their daily jobs supporting the mission of the organization.  Everyone in the organization is responsible for the security of data, so data users are included here as individuals with an information security role.