What is Responsibility?

Understanding Responsibility

Responsibility is the obligation to carry out a specific assigned task, duty, or control within defined parameters. In security governance it identifies who must actually perform an activity. Crucially, responsibility can be delegated to another person or team, whereas accountability for the outcome cannot be transferred away.

Responsibility is operationalized through job descriptions, formal role definitions, delegation procedures, and RACI matrices (Responsible, Accountable, Consulted, Informed). The "R" identifies who does the work; the "A" identifies the single party answerable for it. Frameworks such as ISO/IEC 27001, NIST SP 800-53, and COBIT require organizations to document and assign these responsibilities explicitly so every control has a named owner.

This matters because unassigned or ambiguous responsibility is a leading cause of control failure. When no one is clearly responsible for patching, log review, or access recertification, those tasks silently lapse and become exploitable gaps. Clear assignment also supports separation of duties, preventing any single individual from controlling an entire sensitive process and reducing the risk of fraud or undetected error. Auditors routinely test whether documented responsibilities match what people actually do.

For example, a CISO holds accountability for the overall security program but delegates concrete responsibilities to specialized teams: vulnerability management to the infrastructure group, identity and access administration to the IAM team, and 24/7 alert triage to the SOC. Each responsibility is documented with defined tasks, performance metrics, and reporting lines. If a critical vulnerability goes unpatched, the responsible team must explain why, but the CISO remains accountable to executive leadership and the board for the program's effectiveness. This separation lets work scale across the organization while preserving a clear chain of answerability.