Cyber risk and governance
Who owns remediation and who can accept the risk?
Clarify who coordinates cyber remediation, who can accept risk and who approves exceptions. Keep decision authority, evidence and escalation clear.
By Lisa Elkner4 min readThe remediation owner coordinates the work. Risk acceptance and security exceptions require decision-makers authorised under the organisation’s governance arrangements. Security provides advice and escalation; identifying a gap does not automatically give the security team authority to fix it or accept the risk.
Those responsibilities may sit with the same person in a smaller organisation. In a more complex environment, they may span operations, a service provider, security and a business owner. The test is whether everyone can identify the decision required and who can make it.
Separate the work from the decision
The remediation owner needs sufficient authority to organise the work, manage its dependencies and report progress. That might involve platform changes, a supplier action or a replacement project. Assigning the issue to a security register does not transfer control of those activities to the security team.
The risk decision may sit elsewhere. Someone must decide how the organisation will respond to the exposure, taking account of operational consequences and available treatment options. Their authority should be established through the organisation’s governance arrangements, rather than assumed because they attend the meeting.
An exception also needs an identifiable approval path. The person operating a control may be able to explain a constraint without being authorised to approve a departure from the expected arrangement.
Use a real decision to test the arrangement
A responsibility chart is a useful starting point. Test it against an unresolved issue that requires a choice. If a planned remediation cannot meet its date, who can agree the revised approach? Who considers the continuing exposure? Who can provide the resources or resolve a dependency?
Work through those questions before treating the new date as agreed. A revised schedule may be an operational update, but it can also change the period for which the organisation remains exposed. The person maintaining the schedule should know when that requires a separate risk decision.
Give each responsibility a clear purpose
Remediation, risk decisions, exception approval and security advice each serve a purpose. The roles can be combined where that suits the organisation. What matters is that authority, responsibility and escalation remain clear.
A supplier can perform technical work and provide advice; that does not, by itself, make the supplier the organisation’s risk decision-maker. A short discussion can establish who holds each responsibility without creating another governance framework.
| Responsibility | Owns | Needs confirmed |
|---|---|---|
| Remediation owner | Coordination and completion of the work | Authority to manage actions and dependencies |
| Risk decision-maker | The response to continuing exposure | Authority under the organisation’s governance arrangements |
| Exception approver | The relevant exception decision | The applicable approval path and conditions |
| Security advisers | Advice, assurance and escalation | The exposure, evidence limitations and escalation route |
Make acceptance deliberate and reviewable
The authorised owner needs to make a deliberate decision about the remaining exposure; recording acceptance does not remove that exposure – it merely acknowledges the identified exposure and any existing controls.
Record the decision basis, its scope, the authorised decision-maker and the conditions under which it needs review. If the decision relies on a temporary control or a future project, make that dependency visible. Acceptance should not be read as permission to bypass mandatory security requirements or authorisation conditions.
An unresolved issue is different from an accepted risk. Where no one has made a decision, record that plainly and escalate through the appropriate route. Silence, an overdue action or repeated deferral should not be interpreted as approval.
Keep security responsibility visible
Clarifying operational and business ownership does not remove the security function’s responsibilities. Security still needs to explain the exposure, advise on options, communicate evidence limitations and escalate when decisions or treatment are not progressing.
When remediation is reported complete, establish what supports that conclusion and who will consider any remaining risk. Where the control is still not operating as intended, the issue needs a further action or decision. Closing an administrative task alone does not establish that the original security concern has been resolved.
Strategic Cyber’s Cyber Risk Advisory service supports organisations to clarify risk treatment responsibilities, decision authority and the reporting needed to act on them.