Habit 01 of 18
Governance
A named security lead
One person owns security decisions and reports to the owners.
Without a named owner, security tasks fall between chairs. One person who reports to the owners makes decisions happen and gives customers a name to ask.
Switch it on in the map Counts towards 6 articles, controls and categories
§1 How to do it
How a small firm does it
- Name one person as security lead, in writing. It can be part of an existing role.
- Agree what they can decide alone and what needs the owners.
- Have them report to the owners on a set rhythm, for example every quarter.
- Name a deputy for holidays and sick leave.
Evidence that shows it
- A short role description or an email from the owners appointing them
- Notes or minutes from their regular report to the owners
Ireland: NCSC Ireland guidance on governance and accountability applies here. Irish NIS2 law is still pending.
§2 What it counts towards
What it counts towards
Most links are “supports”: doing this helps you show you meet the reference, without matching it exactly. None of them means “compliant”.
EU NIS2 Directive 2 items
-
Art 20 Management approves and oversees security measures · intersects
Member States shall ensure that the management bodies of essential and important entities approve the cybersecurity risk-management measures taken by those entities in order to comply with Article 21, oversee its implementation and can be held liable for infringements by the entities of that Article.
Article 20 makes management approve and oversee cyber security measures. A named lead who reports to the owners is how a small firm does this day to day, but the legal duty stays with management.
Read Art 20(1) on EUR-Lex -
21(2)(a) Risk analysis and security policies · supports
policies on risk analysis and information system security
This measure asks for security policies. The Commission’s implementing rules for it include defining security roles and responsibilities (Implementing Regulation 2024/2690, Annex §1.2).
Read Art 21(2)(a) on EUR-Lex
ISO/IEC 27001:2022 2 items
-
Cl 5.1 Leadership and commitment · supports
ISO text is copyrighted. Control number and our own description only. Not yet read against the standard.
Top management must show leadership for the management system. A named lead reporting to them is one visible sign of it.
About ISO/IEC 27001:2022 on ISO -
A.5.2 Security roles and responsibilities · supports
ISO text is copyrighted. Control number and our own description only. Not yet read against the standard.
The control asks for security roles to be defined and given to people. Naming a lead is the first of those roles.
About ISO/IEC 27001:2022 on ISO
NIST Cybersecurity Framework 2.0 2 items
-
GV.RR Roles and responsibilities · subset
GV.RR-02: Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced
Naming a lead sets one of the security roles this outcome asks you to establish and communicate.
Read GV.RR-02 on NIST -
GV.OV Oversight · supports
GV.OV-03: Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed
Regular reports from the lead give the owners results to review and act on, which is what oversight means here.
Read GV.OV-03 on NIST
§3 Questions it answers
Indicative mapping, written by hand from public sources. Not legal advice and not a compliance test. Check anything important against the official texts.