Information Security Handbook

Risk ownership

Understanding risk ownership, and who does not own risk, is critically important in order to make the correct risk decisions that support your organization's business and mission objectives:

• Risk ownership is held by the C-suite and/or people at the boardroom level.
• The ability to own risk is tied to authority and the ability to commit funds to reduce risk.
• Senior leaders have the ability to fund risk reduction efforts as well as the ability to change the direction of organizational efforts and culture.
• It is critically important that risks to the organization be effectively communicated to senior leadership with effective, well thought out plans to reduce risk.
• While risk ownership sits with the executive team of an organization, ...