Roles and responsibilities for information security
GOV055
Agency heads, chief information security officers (CISOs), information technology security managers (ITSMs), system owners, and system users all play a part in ensuring that information security is robust. This section outlines and describes the responsibilities for people in these roles.
When you see the word ‘should’, it means the task or activity is best practice. When you see the word ‘must’, it means the task or activity is mandatory. Information security is stronger when you combine best practice and mandatory tasks and activities.
Overall responsibility lies with the agency head
GOV056
If you’re an agency head, you’re accountable for information security within your agency. You are also the accreditation authority for your organisation.
Note: The person responsible for an organisation may have a different title. For example, chief executive officer (CEO), director-general, director, or similar.
Delegate accreditation authority carefully
When you choose to delegate your accreditation authority, you should carefully consider all the associated risks, as you remain responsible for the decisions your delegate makes.
Your delegate should be a senior executive and hold specialised knowledge in information security and security risk management, preferably your chief information security officer (CISO).
If your delegate is not the CISO, they must at least be a member of the senior executive team or in an equivalent management position.
If you delegate authority to a board, committee, or panel, the requirements of this section apply to the chair or head of that body.
When your organisation is small, and duties can’t be fully separated
If you can’t satisfy all separation of duty requirements because of the size of your organisation, you should ensure that potential conflicts of interest are clearly identified, declared, and actively managed.
Support information security throughout your organisation
Without your full support, your people might not have access to enough resources and authority to successfully implement information security within your organisation.
If an incident, breach, or disclosure of official or classified information occurs in preventable circumstances, you will ultimately be held accountable.
You must provide support for developing, implementing, and maintaining information security processes within your organisation.
The CISO leads and oversees information security
GOV057
The CISO’s role is based on good practice in the security industry and in governance. The role ensures that information security is managed at the senior executive level. Without a CISO, your organisation is unlikely to be able to effectively manage information security.
The CISO’s high-level responsibilities
Your CISO, if you have one, has the following high-level responsibilities.
Ensuring the flow of communication supports security objectives
Your CISO facilitates communication between security, ICT, and business personnel to ensure your organisation's security objectives are aligned.
This communication responsibility includes:
- interpreting information security concepts and language into business concepts and language
- ensuring that business teams consult with information security teams to determine appropriate security measures when planning new business projects.
Providing strategic guidance
Your CISO provides strategic guidance on information security. They’re responsible for:
- developing your organisation's information security programme at the strategic level
- overall management of information security within your organisation.
Ensuring your organisation complies with requirements
Your CISO ensures that your organisation complies with:
- national policy, standards, regulations, and legislation for information security
- internal policies and standards for information security.
Making sure training is implemented
Your CISO makes sure that an information security awareness and training programme is developed and maintained.
Lead information security personnel
Oversee the management of information security personnel within your organisation.
Advising and coordinating
Your CISO is best placed to:
- advise ICT project leaders on the strategic direction of information security within your organisation
- provide a recommendation to the accreditation authority on whether to accept residual risks associated with the operation of your organisation’s systems
- coordinate the use of external information security resources to ensure that a consistent approach is applied across your organisation.
Your organisation’s responsibilities with the CISO role
Control your information security budget to ensure that your CISO has enough funding to support information security projects and initiatives.
Do not expect your CISO to necessarily be a technical expert on information security matters. Rather, expect they will use their knowledge of national and international standards and good practice to communicate with technical experts in your organisation.
Appointing a CISO
Your organisation should appoint a CISO or assign the role to someone who already works for your organisation.
The person you appoint to the CISO role should:
- be a member of your senior executive team or an equivalent management position (you don’t need to create a new dedicated position)
- be qualified and experienced enough to bring accountability and credibility to information security management
- report directly to the agency head on matters of information security within the organisation.
Before your CISO begins their role, your organisation must:
- clear them for access to all classified information processed in your organisation’s systems
- be able to brief them on any compartmented information in your organisation’s systems.
Managing conflicts of interest
If your CISO holds another role, such as also being your chief information officer (CIO) or a manager of a business unit, conflicts of interest might arise when operational imperatives conflict with security requirements. Good practice separates these roles.
When your CISO holds multiple roles, you should:
- clearly identify potential conflicts of interest
- implement a mechanism to allow independent decision making in areas where conflict may occur.
If your organisation outsources the CISO function, you should identify and carefully manage conflicts of interest, availability, and response times, so that your organisation is not disadvantaged. Be alert to possible conflicts of interest when the CISO deals with other vendors.
Your responsibilities as a CISO
If you’re a CISO, you should take responsibility for the following tasks.
Develop and maintain your organisation’s information security programme
- Develop and maintain a comprehensive and strategic information security and security risk management programme aimed at protecting your organisation’s official and classified information.
- Lead the development of a communications plan for information security.
- Create and facilitate your organisation’s information security risk management process.
Ensure compliance with policies and standards
- Ensure your organisation complies with its information security policies and standards.
- Ensure your organisation complies with the New Zealand Information Security Manual (NZISM) by facilitating a continuous programme of certification and accreditation based on security risk management.
- Ensure information security metrics and key performance indicators are implemented.
Coordinate and align security with business objectives
- Facilitate information security and business alignment, and communication about these matters through a steering committee or advisory board which meets formally and regularly, and comprises key business and ICT executives.
- Coordinate business and information security teams working on information security and security risk management projects.
- Work with business teams to facilitate security risk analysis and management processes.
- Ensure methods for identifying acceptable levels of risk are consistent across your organisation.
Work with ICT project leaders and managers
- Provide strategic guidance on your agency’s ICT projects and operations.
- Liaise with architecture teams to ensure security and organisation architectures are aligned.
Work with vendors
- Coordinate your organisation’s use of external information security resources, including contracting and managing the resources.
Control budgeting
- Control the information security budget.
Coordinate disaster recovery
- Coordinate the development of disaster recovery policies and standards so that your organisation’s critical functions are supported, and information security is maintained in the event of a disaster.
Oversee training
- Oversee the development and operation of your organisation’s information security awareness and training programmes.
Provide security advice
- Provide authoritative security advice and be familiar with national and international standards and good practice.
ITSMs implement security measures and provide expertise
GOV058
ITSMs are executives within an organisation. They’re conduits between the strategic directions provided by the CISO and the technical efforts of systems administrators. While a CISO sets the strategic direction for information security, ITSMs manage the implementation of information security measures.
ITSMs are generally considered the information security experts within their organisations.
Core aspects of the ITSM’s role
ITSMs are responsible for administrative and process controls relating to information security. Core aspects of their work include contributing to:
- improving the information security of systems
- providing input to ICT projects
- assisting other security personnel within their organisation
- contributing to information security training
- responding to information security incidents.
ITSMs can also provide advice for committees, such as information security steering committees, change management committees, or inter-agency committees.
As ITSMs have knowledge of all aspects of information security, they’re best placed to work with ICT project teams to identify and incorporate appropriate information security measures.
To ensure your CISO remains aware of all information security issues, and can brief their agency head when necessary, ITSMs need to provide regular reports on:
- policy developments
- proposed system changes and enhancements
- information security incidents
- any areas of concern.
While your CISO oversees the development and operation of information security awareness and training programmes, your ITSMs arrange delivery of that training.
Your organisation’s responsibilities with the ITSM role
Your organisation must appoint at least one ITSM. If your organisation is spread across several sites in different locations, you should appoint an ITSM at each major site.
Appointing and clearing ITSMs
Any ITSMs you appoint should:
- have enough experience, authority, and training to fulfil the role in an organisation of your size or in their area of responsibility within your organisation
- be independent of any company that provides ICT services (to avoid conflicts of interest).
ITSMs must be:
- cleared for access to all classified information processed in your organisation’s systems
- hold a national security clearance that allows them to be briefed on any compartmented information in your organisation’s systems.
ITSMs should not have additional responsibilities beyond those needed to fulfil their role.
Your responsibilities as an ITSM
As an ITSM, you must:
- assist system owners to obtain and maintain accreditation
- ensure security risk management plans (SRMPs), systems security plans (SecPlan), and any standard operating procedures (SOPs) for your organisation’s systems are developed, maintained, updated, and implemented.
Working with the CISO
You should work with your CISO to:
- develop an information security programme
- develop information security budget projections and resource allocations based on short-and long-term goals
- undertake and manage projects to address identified security risks.
Working with ICT projects and systems
You should work with ICT project leaders and team members to:
- identify systems that require information security measures and help with selecting the right measures
- ensure that information security is included when IT equipment and software is evaluated, selected, installed, configured, and operated.
You should work with enterprise architecture teams to:
- ensure security risk assessments are incorporated into system architectures
- identify, evaluate, and select information security solutions that will meet your organisation’s security objectives.
You should also work with ICT system owners, certifiers, and accreditors to:
- work out which information security policies will best protect the systems
- ensure consistency with Protective Security Requirements, particularly the relevant NZISM components.
As an ITSM, you should:
- be included in your organisation’s change management and control processes to ensure that risks are properly identified, and controls are properly applied to manage those risks
- notify the accreditation authority of any significant change that may affect the accreditation of that system.
Working with vendors
You should liaise with vendors and with purchasing and legal people in your organisation to establish mutually acceptable information security contracts and service-level agreements.
Implementing security
To implement security measures, you should:
- conduct security risk assessments on any implementation plans for new or updated IT equipment or software, and develop risk mitigation strategies if necessary
- ensure information security policies are robust by selecting and coordinating the implementation of controls that support and enforce them
- lead and direct the integration of information security strategies and architecture with business and ICT strategies and architecture
- provide technical and managerial expertise for the administration of information security management tools.
Reporting and auditing
You should:
- coordinate, measure, and report on technical aspects of information security management
- monitor and report on your organisation’s compliance with, and enforcement of, information security policies
- report regularly on information security incidents and other areas of concern to your CISO
- assess and report on threats, vulnerabilities, and residual security risks
- recommend remedial actions to reduce risks
- assist system owners and security personnel to understand and respond to audit failures reported by auditors.
Assisting with disaster recovery
You should assist the team responsible for disaster recovery planning with:
- selecting recovery strategies
- developing, testing, and maintaining disaster recovery plans.
Training
You should:
- provide or arrange information security awareness and training for everyone in your organisation
- develop technical information materials and workshops on information security trends, threats, good practices, and control mechanisms as appropriate.
Providing up-to-date security knowledge
As an ITSM, you should:
- maintain an up-to-date security knowledge base comprising of a technical reference library, security advisories and alerts, information on security trends and practices, relevant laws and regulations, and standards and guidelines
- provide expert guidance on security matters for ICT projects
- provide technical advice for your information security steering committee, change management committee, and any other committees as required
- maintain an up-to-date and accurate understanding of the threat environment relating to systems and pass this information to system owners so it’s considered during accreditation activities
- keep the CISO and system owners informed with up-to-date information on current threats.
System owners maintain and operate systems
GOV059
All systems must have an owner.
All system owners need to ensure IT governance processes are followed and that business requirements are met.
System owners for large or critical systems should be part of your organisation’s senior executive team or hold an equivalent management position.
Your responsibilities as a system owner
As a system owner, you’re responsible for the overall operation and maintenance of a system, including any related support service or outsourced service, such as a cloud service.
You may delegate the day-to-day management and operation of the system to a system manager or managers.
Operating the system and maintaining accreditation
You must ensure the system you own is accredited to meet your organisation’s operational requirements. You are responsible for obtaining and maintaining accreditation.
If the system is modified, you need to ensure:
- the changes are done properly and documented
- that any necessary reaccreditation activities are completed.
Developing, maintaining, and implementing documentation
As a system owner, you must ensure that information security documentation for the system is developed, maintained, and implemented. Documentation for the system includes SRMPs, SecPlans, and SOPs.
You should involve security personnel in the documentation process to ensure a holistic approach to information security can be mapped to your understanding of security risks for your specific system.
You must ensure the documentation is complete, accurate, and up to date. You must also document the actions you take to develop, maintain, and implement the documentation.
You must involve your ITSM when you redevelop or update information security documentation.
For more information see the following chapters of the NZISM:
System users protect systems by following policies and procedures
GOV060
Developing and maintaining a security culture helps system users comply with security policies and procedures. System users need to be aware of the risks to any system they use and understand the part they play in reducing those risks.
Your responsibilities as a system user
As a system user, whatever your level of access, you must:
- comply with the security policies and procedures for the system
- ensure your account authenticators are strong enough to protect the system (for example, passwords and other login details)
- not share authenticators for accounts without approval
- take responsibility for all actions under your account
- only use your access to perform authorised tasks and functions.
When you want to bypass a policy or procedure
Security policies and procedures aim to cover all situations that may arise within an organisation. However, sometimes you may have a legitimate reason for wanting to bypass a policy or procedure. If this is the case, you must seek and get formal approval from your CISO or ITSM before you act.
