4.2.2.1

Accountability

Accountability – Top Management’s Appointment of Senior-level IT Security Leadership – Top management shall appoint a member of the senior-level leadership team to oversee and be accountable for the organization’s IT security. Accountabilities of the member of the senior-level leadership team shall include the following:

1. Developing and implementing a company-wide information cyber security program to meet baseline cyber security controls;
2. Documenting and disseminating information security policies and procedures;
3. Coordinating the development and implementation of a company-wide information security training and awareness program;
4. Coordinating a response to actual or suspected breaches in the confidentiality, integrity, or availability of the organization’s data; and
5. Identifying organizational risks and prioritizing risk treatment relative to likelihood and potential impact of cyber threats.