Cybersecurity responsibilities for the function are identified, at least in an ad hoc manner
Context and Guidance: Identify the roles and activities needed to meet the needs of the function’s cybersecurity program. This would include typical cybersecurity roles such as security administrator, network administrator, and chief information security officer (or a similar role) and their assigned activities. Cybersecurity responsibilities are not restricted to traditional cybersecurity or IT roles. For example, operations engineers, human resources specialists, and procurement specialists typically have cybersecurity roles, and these roles may be performed by third parties. It may be useful to consider consulting industry best practices or frameworks, such as the NICE Cybersecurity Workforce Framework (NIST Special Publication 800-181) for help in identifying and describing fundamental cybersecurity responsibilities.
Related Practices • Progression: This practice is part of a practice progression. Practice progressions are groups of related practices that represent increasingly complete or more advanced implementations of an activity. The practices in this progression include: WORKFORCE-3a, WORKFORCE-3d, WORKFORCE-3e.