c4.1 Share security work and responsibility
Security is everyone’s responsibility, not just the security team’s. Document who does what in a RACI matrix, and for ambiguous, low-risk decisions, delegate the call to the business owner who has the context — preserving your scarce specialists for strategic work.
Implementation guidance
Document responsibilities in a RACI
Many security-relevant tasks are performed by other teams — IT often runs backups, developers write infrastructure as code. Capture these collaborations in a RACI (Responsible, Accountable, Consulted, Informed) matrix. For example, IT may be Responsible for taking backups while the security team is Accountable for confirming they are taken correctly; defining backup frequency and retention may be a separate task the security team owns with the business Consulted on requirements. If a team delegates a task to a third party, confirm the contract covers it.
Delegate ambiguous decisions to those with context
Clear cases are automatic: an attack on a critical vulnerability is simply blocked. But for ambiguous, low-risk anomalies, the security team is often not the right decision-maker and rarely has the capacity to investigate every one. Instead, enrich the finding with business context and route the decision to the owner. For example, a rate-based AWS WAF rule flags a pool of IPs generating a high order volume you can absorb — add the authenticated usernames behind those IPs and any fraud signals (account age, past transactions, low-reputation contact data), then let the business owner decide whether to allow or block. This preserves your scarcest resource — qualified specialists — for strategic work.
How to validate
- Are security-relevant tasks delegated to the right teams with clear ownership?
- Is there a RACI matrix, and is it detailed enough to be actionable?
- Where a task is delegated to a third party, does the contract cover it?
- Do you route ambiguous, low-risk decisions to the business owner with enriched context?
Threats addressed
- When security is treated as one team’s job, gaps appear in tasks other teams actually perform, and specialists get consumed by operational decisions others are better placed to make.