What it means
Clear accountability distinguishes business ownership from technical custody and separates execution, oversight, assurance, and acceptance where conflicts could weaken decisions.
Why it matters
Ambiguous roles create unowned risk, duplicated work, delayed response, and the expectation that the security team is responsible for decisions it cannot control.
Practical focus
- Assign one accountable owner for each important outcome
- Define decision authority and escalation
- Document interfaces across business, IT, legal, privacy, audit, and suppliers
- Review roles after reorganizations and major service changes
Common mistakes
- Using a RACI chart without real authority
- Assigning accountability to a committee
- Making security responsible for all technology risk
- Failing to cover after-hours and crisis decisions
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: