Security jobs by role: who does what.

Who is who

The official guidance splits the work by role. Here is how those roles map to a small organization.

CISA, the US Cybersecurity and Infrastructure Security Agency, splits its advice for small businesses by role: what the chief executive does, what a “Security Program Manager” does, and what the IT lead does. It says it starts with the chief executive because cybersecurity is about culture as much as technology, and culture cannot be delegated. The UK National Cyber Security Centre (NCSC) makes the same point from the other side: its small organisations guide says not to leave the responsibility with a single person, because cyber security is everyone’s business.

In a small organization the names differ, and one person may hold more than one role. This guide uses:

• The director: the executive director, chief executive, owner or whoever runs the organization day to day (CISA’s “CEO”).
• The board: the trustees, directors or committee that govern it, if it has one. CISA’s page does not mention boards; this part follows the NCSC’s Board Toolkit, which is written for small and medium organizations among others.
• The person responsible: one named person who keeps security moving. CISA calls this the Security Program Manager and says they don’t need to be a security expert or even an IT professional.
• IT help: whoever looks after your systems: a staff member, a volunteer or an outside provider (CISA’s “IT lead”).
• Everyone: every staff member and volunteer, the director and board included.

Each job below says where it comes from and links to the free Commons tool that helps with it.

At a glance

One table for the wall, or the next board pack.

The director

CISA: “Culture cannot be delegated.” These are the jobs only the person in charge can do.

• Talk about security, and set goals for it. CISA asks the chief executive to talk about cybersecurity with direct reports and the whole organization, to include updates in regular staff emails, and to include security objectives when setting quarterly goals with the leadership team, such as how many accounts use multi-factor authentication (MFA), how many systems are fully patched and how many are backed up. The self-assessment gives you a starting point to measure from.
• Choose the person responsible, and support them. CISA says to select and support a Security Program Manager, who should report progress and roadblocks to you and other senior leaders at least monthly, or more often in the beginning.
• Review and approve the incident plan. CISA asks the chief executive to give the incident response plan attention in “peace time”, and to involve leaders from across the organization, not only security and IT, because there will be no time to digest it during an incident. The incident plan builder writes a first draft you can review.
• Use the plan for near misses too. CISA’s tip is to invoke the plan even when you suspect a false alarm, so near misses lead to improvements. The incident log keeps a record as you go.
• Take part in exercises. CISA asks the chief executive to make sure senior leaders attend and take part in the practice exercises the person responsible runs.
• Take ownership of the jobs that need everyone. CISA’s example: rather than asking IT to persuade busy staff to turn on MFA, announce it to staff yourself, keep track of progress, and follow up personally with people who have not enabled it. More on MFA in Security basics.
• Follow the rules yourself. The NCSC’s Board Toolkit warns that when senior leaders ignore policies or ask for special treatment, it tells everyone else it is acceptable to bypass them.

The board

Oversight, not operations: asking the right questions and setting the tone.

The NCSC’s Cyber Security Toolkit for Boards is organized around the UK’s Cyber Governance Code of Practice. The NCSC says the Code was designed for medium and large organizations, not specifically for smaller ones, and that small organizations may use it to inform how they govern cyber risk, depending on their maturity and risk.

• Set the tone. The Toolkit says board members set the tone for security culture and should be good role models, including keeping the information they use safe and knowing what to do if they think they have been targeted.
• Listen, not only instruct. It says the board should not work solely top-down, but listen to people across the organization about how changes affect their work.
• Ask for assurance that there is a plan. It says board members should seek assurance that incident planning, response and recovery are being managed, and that the plan sets out how severity is decided, who has authority to make key decisions, and who contacts board members, suppliers and regulators. Ask to see the plan; the incident plan builder covers those points.
• Know your own role in an incident. The Toolkit says everyone should understand their role and authority in advance, including for incidents outside normal hours, and that board members can take part in exercises as observers or players.
• Make sure lessons are learned, without blame. It asks boards to make sure the organization reviews incidents afterwards, notes that “no blame doesn’t mean no accountability”, and, separately, suggests rewarding people for demonstrating good cyber security behaviors. After an incident: a short, blameless review has an agenda and template.
• Count reports, not only clicks. It warns that valuing an absence of reported problems teaches people to keep quiet, and suggests measuring, for example, how many people reported a phishing email as well as how many clicked. The phishing drill kit is built that way.

The NCSC also publishes a short set of questions for board members to ask about cyber security, linked from the Toolkit page in the sources.

The person responsible

One named person who keeps things moving and reports on progress.

• Train everyone. CISA says all staff must be formally trained to understand the organization’s commitment to security, the tasks they need to do (such as enabling MFA, updating their software and avoiding suspicious links that could be phishing) and how to report suspicious activity. The phishing drill kit has a briefing and practice examples; the acceptable use policy template sets out the rules in writing.
• Write and keep the incident plan. CISA says the plan spells out what to do before, during and after an incident, with roles and responsibilities, and that the person responsible should get the chief executive and other leaders to formally approve it, then review it quarterly and after every incident or near miss. Start with the incident plan builder.
• Keep a contact list that works offline. CISA says the plan should include an address book for use if the network is down. The incident contact sheet template is one way to keep it.
• Run practice exercises. CISA asks the Security Program Manager to host quarterly tabletop exercises: a role-play in which the organizer presents scenarios and the team talks through its response. The NCSC describes exercises as being as important as fire drills. Write down what you learn and feed it into a review.
• Check MFA, with someone else. CISA says making sure all staff use MFA to sign in to key systems, especially email, is the most important step, and that more than one person must review MFA status regularly. The self-assessment asks about it.
• Report to the director. CISA describes the role as driving the security program, telling the chief executive about progress and roadblocks, and making recommendations.

IT help

The technical controls behind the habits: settings that make the safe way the default.

• Make MFA compulsory with settings, not requests. CISA says some people never enroll when only asked, that gaps are common for new staff and people with new phones, and that IT should regularly look for accounts without MFA and fix them. Where passkeys are available, the NCSC says to enable them for business-critical accounts as a priority.
• Start with administrator accounts. CISA says to enable MFA for every system administrator account, because attackers target them. See admin accounts.
• Keep software updated. CISA calls patching one of the most cost-effective ways to improve security, says to turn on automatic updates where possible, and points IT to its Known Exploited Vulnerabilities Catalog to decide what to fix first. See updates.
• Back up, and test restoring. CISA says scheduling backups is not enough: test partial and full restores regularly, choose how often to back up, and write a plan for restoring. The NCSC adds that you should know how to restore a backup and check it holds all your important data. The backup planner and the backup restore log help.
• Remove administrator rights from everyday laptops. CISA explains that a user without administrator rights cannot install software, so a common trick of getting people to run harmful software fails.
• Encrypt laptops. CISA says Windows and Mac laptops must be set up to encrypt their drives, because laptops are lost and stolen. The device and account inventory template has a place to record it.
• Check the email domain. The email check reads your domain’s public settings (SPF, DKIM, DMARC) and explains each result in plain English.

Everyone

The NCSC: cyber security is everyone’s business.

• Do your part of the basics. CISA lists the tasks staff are trained to do: enable MFA, update their software, and avoid clicking suspicious links. The NCSC says to use a strong password that you don’t use anywhere else for important accounts, with 2-step verification.
• Know the signs. The NCSC lists how attacks often start quietly: unusual emails, customers getting emails you did not send, a sign-in alert you don’t recognize, a device behaving oddly, payments you did not make.
• Check with the sender, the safe way. If you have doubts about a message, the NCSC says to contact the organization directly using the details on its official website, not the numbers or links in the message. For requests to change bank details, see payment fraud.
• Report quickly, and without fear. CISA says staff should know how to report suspicious activity; the NCSC says people act as an early-warning system and need a simple way to report. If you clicked something, After a phishing click explains the next steps.
• Think about what you share. The NCSC suggests checking what the organization’s website and social media reveal, such as staff profiles, and reviewing privacy settings on social media accounts.
• Know where the plan is. The NCSC’s small organisations guide says to have a plan that defines who does what, and when, if something goes wrong. Keep the plan and the incident log somewhere everyone can find them.