12.1.4 Responsibility for information security is formally assigned to a Chief Information Security Officer or other information security knowledgeable member of executive management.

Defined Approach Requirements

12.1.4 Responsibility for information security is formally assigned to a Chief Information Security Officer or other information security knowledgeable member of executive management.

Customized Approach Objective

A designated member of executive management is responsible for information security.

Defined Approach Testing Procedures

12.1.4 Examine the information security policy to verify that information security is formally assigned to a Chief Information Security Officer or other information security-knowledgeable member of executive management.

Purpose

To ensure someone with sufficient authority and responsibility is actively managing and championing the organization's information security program, accountability and responsibility for information security needs to be assigned at the executive level within an organization.

Good Practice

These executive management positions are often at the most senior level of management and are part of the chief executive level or C-level, typically reporting to the Chief Executive Officer or the Board of Directors. Information security knowledge for this executive management role can be indicated by work experience, education, and/or relevant professional certifications. The expectation is that this individual can provide assurance about the implementation of an effective security program and ensure the right technical experts are employed.

Entities should also consider transition and/or succession plans for these key personnel to avoid potential gaps in critical security activities.

Definitions

The Chief Information Security Officer (CISO) or equivalent role is responsible for establishing and maintaining the enterprise vision, strategy, and program to ensure information assets and technologies are adequately protected. This executive is responsible for directing staff in identifying, developing, implementing, and maintaining processes across the organization to reduce information and information technology risks.

Further Information

Refer to industry standards and the PCI DSS standard for further information on requirement 12.1.4.