5.2

4.2.2.1 – Top management shall appoint a member of the senior-level leadership team to oversee and be accountable for the organization’s IT security. Accountabilities of the member of the senior-level leadership team shall include the following:

1. developing and implementing a company-wide information cyber security program to meet baseline cyber security controls;

2. documenting and disseminating information security policies and procedures;

3. coordinating the development and implementation of a company-wide information security training and awareness program;

4. coordinating a response to actual or suspected breaches in the confidentiality, integrity, or availability of the organization’s data; and

5. identifying organizational risks and prioritizing risk treatment relative to likelihood and potential impact of cyber threats.