Crossfoot
Crossfoot / Controls / Security roles and accountability
Draft v0.1.06 of 6 frameworks

Security roles and accountability

Named owners for security, defined responsibilities and segregation of duties.

Where it appears

SOC 2
CC1.3Establishes structure, authority and responsibility
CC1.5Enforces accountability
PCI DSS 4.0
12.1.3Security policy defines information security roles and responsibilities
12.4.1Executive management responsibility for protection of cardholder data (service providers)
NIST CSF 2.0
GV.RRRoles, responsibilities and authorities
ISO 27001:2022
A.5.2Information security roles and responsibilities
A.5.3Segregation of duties
HIPAA Security Rule
164.308(a)(2)Assigned security responsibility
NIST 800-53 r5
PM-2Information security program leadership role
AC-5Separation of duties

Evidence auditors usually ask for

A typical starting list. Your assessor's request list is the one that counts.

  • Organization chart showing the security/compliance function and reporting line
  • Job descriptions or role charters with security responsibilities
  • RACI or responsibility matrix for security controls
  • Documented segregation-of-duties rules for sensitive functions

Crosswalks that include this

SOC 2 to PCI DSS 4.0SOC 2 to NIST CSF 2.0SOC 2 to ISO 27001:2022SOC 2 to HIPAA Security RuleSOC 2 to NIST 800-53 r5PCI DSS 4.0 to SOC 2PCI DSS 4.0 to NIST CSF 2.0PCI DSS 4.0 to ISO 27001:2022PCI DSS 4.0 to HIPAA Security RulePCI DSS 4.0 to NIST 800-53 r5NIST CSF 2.0 to SOC 2NIST CSF 2.0 to PCI DSS 4.0