Assign every decision in an estate to somebody who can make it

short · 35 min · Objective 5.1

Task

Take a small estate and build the RACI for its security decisions, then find the decisions that have no accountable party. The gap is always in the same places, and finding it on paper is considerably cheaper than finding it during an incident.

Steps

  1. List the assets in your lab estate and, for each, the data it holds and the classification you would give that data.
  2. Write /tmp/raci.csv with the columns decision,responsible,accountable,consulted,informed, and fill in at least ten decisions: who may access this data, how long it is kept, whether this risk is accepted, when this system is patched, who approves this change, who declares an incident, who talks to a regulator, who signs off a vendor, who revokes access, and who decommissions an asset.
  3. Enforce the rule that makes RACI work: exactly one accountable party per row. Where you are tempted to name two, you have found a decision that will stall.
  4. Mark any row where the accountable party is 'the security team'. For most of these — access to data, retention, accepting risk — that is the wrong answer, and the right one is a business owner.
  5. For each of those, name the business role that should hold it and why.

Verify

awk -F, 'NR>1 && NF>=5 {n++} END {print n" decision(s) assigned"}' /tmp/raci.csv
python3 - <<'PY'
import csv
rows=list(csv.DictReader(open('/tmp/raci.csv')))
assert len(rows)>=10, 'fewer than ten decisions'
multi=[r['decision'] for r in rows if ',' in r['accountable'] or '/' in r['accountable'] or ' and ' in r['accountable'].lower()]
assert not multi, 'more than one accountable party for: '+', '.join(multi[:3])
sec=[r['decision'] for r in rows if 'security' in r['accountable'].lower()]
print('decisions accountable to the security team:',len(sec))
assert len(sec)<=3, 'the security team is accountable for nearly everything - decisions about data and risk belong to the business'
print(len(rows),'decisions, each with exactly one accountable party')
PY

The single-accountable rule is enforced by the assertion because it is the rule RACI exists for and the one everybody breaks. The second assertion is the lesson's point: if the security team is accountable for who may see the finance data and how long it is kept, the organisation has confused implementing a control with owning a decision.

Notes

The rows you had to reassign are the interesting ones. Security implements, advises and measures; the business owns the data and accepts the risk. When that line is blurred, the person who finds a risk ends up accepting it, which is a decision they have no authority to make and no way to fund.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.