Policy brief
Who Owns Cyber Risk in High-Assurance Environments?
Policy brief · Separate advice, operational ownership and the authority to accept residual risk.
The policy choice
A CISO can explain exposure without having authority to accept consequences for an entire mission. NIST CSF 2.0 addresses governance; the NIST Risk Management Framework structures security and privacy risk management across the system life cycle. [1][2] Neither removes the need to define authority in the organisation’s own context.
A proposed allocation
We propose that the mission owner defines the operational consequence; the system owner implements treatment; the CISO challenges assumptions and assesses evidence; and the explicitly designated authorising authority accepts residual risk. One person may hold several roles, but the decision record should state which authority is being exercised. This is our model, not a universal legal rule.
Make exceptions expire
For an urgent access exception, compare denial, restricted temporary access and full access with compensating controls. Record the selected option, rationale, scope, expiry, monitoring and escalation trigger. Avoid indefinite acceptance merely because a remediation budget is unavailable. Temporary access also has operational cost; document who bears it.
Measure the quality of governance
Review expired exceptions, overdue treatments and decisions reopened after incidents. An audit function should be able to challenge the evidence without owning the operational decision it evaluates. The test is traceability: can a successor understand what was accepted, by whom, on what evidence and until when?
Use a decision record that survives a change of leadership
A useful record contains the mission at risk, plausible scenario, available options, expected consequences, evidence limitations and the authority making the decision. It also names the person responsible for treatment and the conditions that trigger review. Avoid recording only a colour or numerical score. A successor should be able to reconstruct why continuing operations was judged preferable to restriction or suspension, even when the original participants have left.
An illustrative exception
Imagine a contractor needs temporary access to support a vessel before departure. Denying access may delay the operation; unrestricted access may create an unacceptable dependency on an external identity. A narrower option could use a supervised session, limited permissions and a defined expiry, subject to technical feasibility. The decision should explain why the chosen restriction addresses the relevant scenario and what evidence will confirm that access has ended. This is a hypothetical example, not a claim about a real operation.
Separate approval from assurance
The person implementing a control can provide evidence, but high-consequence decisions benefit from challenge by someone able to identify omitted assumptions. That challenge need not become an endless approval chain. Define which decisions require independent review, what information must be supplied and how urgent decisions will be revisited. Governance should reveal the trade-off quickly enough to support the mission, while leaving an accountable record of the uncertainty accepted.
References
- NIST · The Cybersecurity Framework (CSF) 2.0 · 26 February 2024
- NIST · SP 800-37 Rev. 2 · December 2018
Cyber Policy Review · Editorial analysis. Original paraphrases; no verbatim quotations. Framework references do not imply certification or endorsement.
Publications