What it means
Accountability is the condition in which responsibility is assigned and actions can be connected to the person, role, process, or system that performed them. In cybersecurity, it depends on more than naming an owner. The organization also needs decision rights, records, escalation paths, and consequences that make ownership meaningful.
How it works
Identity, authorization, logging, approvals, change records, and review processes work together to support accountability. A log may show which account changed a firewall rule, but the surrounding process should also show who approved the change, why it was needed, and who accepted the remaining risk. Accountability therefore combines technical attribution with organizational governance.
A service owner can delegate daily administration without giving away accountability for the service. Administrators perform the work, managers approve important changes, and the service owner remains answerable for whether controls, resources, and risk decisions are adequate.
Practical focus
- Assign one accountable owner for each important asset, service, control, and risk
- Separate the person who performs work from the person who approves or reviews it when practical
- Use named accounts and protected audit records instead of shared credentials
- Define escalation and exception paths before a high-pressure incident
Common mistakes
- Confusing participation with accountability
- Assigning ownership without authority, resources, or access to evidence
- Treating logs as sufficient when identities or timestamps cannot be trusted
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: