What it means
It covers roles, services, decision rights, handoffs, shared responsibilities, sourcing, escalation, and the relationship between the security function and product or business teams.
Why it matters
A strategy cannot succeed when the organization lacks clear ownership, delivery mechanisms, or capacity to carry it out.
Practical focus
- Define security services and their customers
- Clarify central, federated, and embedded responsibilities
- Design funding and prioritization mechanisms
- Measure service outcomes and improve handoffs
Common mistakes
- Copying another company's organization chart
- Centralizing every decision in the CISO team
- Embedding security without standards or community
- Leaving operational ownership ambiguous between security and IT
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: