VIBRANTBOOTCAMP.CO.UK

Longest Duration MCSE Boot Camps
98% Success Ratio 
MCSE CCNA camp Back to Back

MCSE Boot Camp

Defining Roles and Responsibilities

The establishment of clear roles and responsibilities is a critical success factor for any risk management program due to the requirement for cross-group interaction and segregated responsibilities. The following table describes the primary roles and responsibilities used throughout the Microsoft security risk management process.

Table 3.3   Primary Roles and Responsibilities in the Microsoft Security Risk Management Process

The Security Risk Management Team will encounter first-time participants in the risk management process who may not fully understand their roles. Always take the opportunity to provide an overview of the process and its participants. The objective is to build consensus and highlight the fact that every participant has ownership in managing risk. The following diagram, which summarizes key participants and shows their high-level relationships, can be helpful in communicating the previously-defined roles and responsibilities and should provide an overview of the risk management program.

To summarize, the Executive Sponsor is ultimately accountable for defining acceptable risk and provides guidance to the Security Risk Management Team in terms of ranking risks to the business. The Security Risk Management Team is responsible for assessing risk and defining functional requirements to mitigate risk to an acceptable level. The Security Risk Management Team then collaborates with the IT groups who own mitigation selection, implementation, and operations. The final relationship defined below is the Security Risk Management Team's oversight of measuring control effectiveness. This usually occurs in the form of audit reports, which are also communicated to the Executive Sponsor.