Implementation is a critical area and it requires good project management to balance the implementation of the controls and the associated costs. There is a wide range of internal and external resources available to accomplish this, but at a basic level every organisation going down this pathway needs to identify a specific person responsible for information and system security.

 In larger organisations this is the principal role of the Chief Information Officer (CIO). In smaller organisations it may be the responsibility of a single person who also has other responsibilities within the organisation.

In some cases an external provider may undertake this role, in which case it is vital that you understand what support and service the outsource company will supply.

The key is to identify who is responsible for what and not to assume that security has been addressed by a third party.

Next topic in this section >