Cissp: Layers Of Responsibility, Personnel Security

Front 1

board of directors

Back 1

group of individuals who are elected by the shareholders
of a corporation to oversee the fulfillment of the corporation’s charter

Front 2

chief executive officer (CEO)

Back 2

has the day-to-day management responsibilities of an organization.This person is often the chairperson of the board of directors and is the highestranking
officer in the company.

Front 3

chief financial officer (CFO)

Back 3

responsible for the corporation’s account and
financial activities and the overall financial structure of the organization.

Front 4

chief information officer (CIO)

Back 4

responsible for the strategic use and management of information systems and technology within the organization.

Front 5

chief privacy officer (CPO)

Back 5

responsible for ensuring that customer, company, and employee data
are kept safe, which keeps the company out of criminal and civil courts and hopefully
out of the headlines

Front 6

chief security officer (CSO)

Back 6

responsible for understanding the risks that the
company faces and for mitigating these risks to an acceptable level. responsible
for understanding the organization’s business drivers and for creating and maintaining
a security program that facilitates these drivers, along with providing security,
compliance with a long list of regulations and laws, and any customer expectations or
contractual obligations.

Front 7

security steering committee

Back 7

responsible for making decisions on tactical and
strategic security issues within the enterprise as a whole and should not be tied to one
or more business units. The group should be made up of people from all over the organization
so they can view risks and the effects of security decisions on individual departments
and the organization as a whole

Front 8

audit committee

Back 8

should be appointed by the board of directors to help it review and
evaluate the company’s internal operations, internal audit system, and the transparency
and accuracy of financial reporting so the company’s investors, customers, and creditors
have continued confidence in the organization.

Front 9

Data owner

Back 9

Individual responsible for the protection and
classification of a specific data set.

Front 10

Data custodian

Back 10

Individual responsible for implementing and
maintaining security controls to meet security requirements outlined
by data owner.

Front 11

Separation of duties

Back 11

Preventive administrative control used to ensure
one person cannot carry out a critical task alone.

Front 12

Collusion

Back 12

Two or more people working together to carry out
fraudulent activities.

Front 13

Rotation of duties

Back 13

Detective administrative control used to uncover
potential fraudulent activities

Front 14

Mandatory vacation

Back 14

Detective administrative control used to uncover
potential fraudulent activities by requiring a person to be away from
the organization for a period of time.