Managed cybersecurity: who is responsible for what?

Your organization may use an IT provider, several cloud applications and devices managed in different ways. Before dividing responsibilities, put these elements on one list. Identify the accounts, devices and applications included in the proposed service, as well as any environments excluded from it. A list of purchased products does not establish who follows up on them.

The Canadian Centre for Cyber Security recommends identifying the systems within scope and documenting incident response responsibilities. These principles help frame the conversation with your providers. The worksheet below is an original planning tool to adapt to your agreement, rather than a service certification or a statement that your organization meets a standard.

Baseline cyber security controls for small and medium organizations

For planning purposes, we suggest three distinct questions: who performs the task, who can authorize its effect on operations, and who confirms completion? One person may hold several roles, but the allocation should remain explicit. A provider might recommend blocking an account; your organization needs agreed conditions under which that provider can act directly.

Include the owner of the affected application or business activity. A technically available change may interrupt essential work. That owner contributes the operational context needed to decide. Avoid phrases such as “coordinate with IT” without identifying a contact, a communication channel and an alternate when the usual contact is unavailable.

Select a recurring task and fill in the following fields with your team and the provider. Start with one concrete activity instead of attempting a comprehensive risk catalogue. Where answers conflict, keep the issue open until someone makes and records a clear decision.

• Task and scope: what action applies to which accounts or devices?
• Execution: who receives the request and performs the work?
• Authority: who decides, and which actions are already permitted?
• Coverage: what hours, channels and conditions have been agreed?
• Escalation: who handles a blocked task or an out-of-scope situation, and who is their alternate?
• Completion: what evidence establishes the outcome, and who reviews it?

A fictional small business receives a report about its sales manager’s account. The security provider can examine the information covered by its agreement. The IT provider administers the account, while the sales director understands the operations that depend on access. Without a prior allocation of responsibility, each participant could wait for another to make a decision.

In this planning example, the three parties complete a worksheet naming who examines the report, who may suspend access under agreed conditions and who informs the affected person. They also record the procedure when a responsible contact is absent. The scenario represents no actual response time or customer result. Its purpose is to expose missing questions before a real situation occurs.

During a service review, select one completed action and one pending action. Ask what was observed, what was decided, who decided and what remains outstanding. A count of received notifications does not answer those questions. A short list of open decisions can be more useful than a lengthy report with no clear recipient or next step.

Repeat this exercise when a new application enters service or a provider changes. The initial worksheet is a starting point that should evolve with your organization. If you want to prepare this allocation with Loupe Technologies, managed cybersecurity scoping can help examine the systems involved and the operating arrangements that need to be agreed.