Domain 1 · Objective reference 1A3 · Chapter 3 of 35
Structures, roles and decision authority
About 5 minutes · Detailed public baseline effective 2022; the replacement exam starts 3 November 2026 and its exact revised topic/task mapping remains unverified
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: Accountability needs authority not just a job title.
Explore the anchors
Set direction and oversight.
Concept matching activity
Match this task or description to its concept:
Authorize priorities and risk decisions.
Choose a concept before checking the explanation.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Management concept and decision mechanism
- Give each decision an owner
Management concept and decision mechanism
Corporate governance establishes direction and oversight; management organizes execution within that direction. Information-security governance should fit the existing investment, risk and accountability routes rather than operate as an isolated approval structure. Distinguish the information owner, risk owner, control operator, service owner and assurance function. One person can hold several roles, but incompatible responsibilities and conflicts need explicit treatment. A RACI-style allocation helps clarify participation, yet a chart is not evidence that people understand or exercise authority. Specify who decides exceptions, accepts residual exposure and escalates material failures.
Give each decision an owner
Security work crosses business, technology, legal, procurement, and assurance teams. A governance structure makes their decisions explicit. Senior leadership establishes direction and oversight. A business risk owner evaluates consequences for the service or objective they own. Control owners maintain safeguards. Security specialists advise and coordinate. Independent assurance evaluates whether the arrangements work.
Job titles alone do not establish authority. A security manager may also hold a delegated approval role, but that delegation should be documented. A supplier can operate a control without becoming the organization's authority for accepting the resulting business risk.
Worked example
A control operator identifies a failed safeguard but sends the acceptance decision to the authorized business risk owner.
Check your understanding
Does responsibility for running a control automatically grant authority to accept its business risk?
Show explanation
No. Operational responsibility and risk-acceptance authority are different accountabilities that must be delegated explicitly.
Source and study boundary
Official syllabus source. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.