Roles, responsibilities and workforce plan
| Organisation / system scope | [Organisation] / [System or programme] |
|---|---|
| Document ID / version / status | RO / [Version] / [Draft or approved] |
| Owner / approving authority | [Named owner] / [Named approving authority] |
| Effective date / next review | [Date] / [Date or linked schedule ID] |
| Adoption decision record | [AD-01 record location and version] |
RO-01 — Assignment policy
[Organisation] assigns responsibility and authority for the adopted SSDLC activities. The programme owner maintains the role register and confirms that each assigned person understands the work, available authority, required evidence and escalation route. Assignment includes the system or organisational scope and the period for which it applies. A team mailbox may provide continuity, but the record identifies the person accountable for ensuring the work is performed.
Roles may be combined, shared or contracted according to the organisation’s circumstances. The register states how decisions are made where responsibility is shared. Where the same person performs work and assesses it, the assurance plan records the arrangement and its effect on confidence. Additional review is selected where required by an adopted control, agreement or risk decision; this policy does not presume that every organisation can maintain separate full-time positions.
RO-02 — Programme and system responsibilities
| Role | Responsibility | Appointment |
|---|---|---|
| Sponsor | Approve mandate, resources and programme direction; resolve escalated decisions; review assurance. | [Name / deputy] |
| Programme owner | Maintain policies, adoption decisions, assignments, schedules and programme reporting. | [Name / deputy] |
| System owner | Maintain purpose, scope, operating responsibilities, stakeholder engagement and system risk decisions within delegation. | [Name / deputy] |
| Delivery coordinator | Plan work, dependencies, resources, reviews and handovers; report unmet commitments. | [Name / deputy] |
| Security lead | Coordinate security requirements, analysis, threat assessment and control implementation advice. | [Name / deputy] |
| Privacy lead | Coordinate privacy needs, processing assessment, information rights and privacy risk advice. | [Name / deputy] |
| Engineering lead | Maintain architecture, technical decisions, implementation practices and configuration knowledge. | [Name / deputy] |
| Verification lead | Maintain test plans, requirement coverage, execution records and defect reporting. | [Name / deputy] |
| Supplier owner | Maintain supplier assessment, agreement requirements, performance review and exit arrangements. | [Name / deputy] |
| Operations owner | Maintain operational readiness, monitoring, maintenance, support and recovery arrangements. | [Name / deputy] |
| Assurance lead | Plan assessments, evaluate evidence, report findings and track corrective action. | [Name / deputy] |
| Decision authority | Make the risk, change, release or other decisions expressly assigned in the authority record. | [Name / deputy] |
RO-03 — Responsibility record
For every adopted activity, the programme owner records who performs the work, who makes the associated decision, who is consulted and who receives the result. The record names the required output and where it will be retained. These assignments may be expressed as a RACI table where useful, but the underlying decision rights and work remain explicit. A letter in a table does not define a delegation limit.
Responsibility ID: [RO record ID] Activity / promise IDs: [Document clauses and scope] Performer: [Name and role] Decision authority: [Name; decision type; delegation limits] Consulted / informed: [Stakeholder IDs] Deputy / absence arrangement: [Name; activation conditions] Output and evidence location: [Record or deliverable] Schedule / trigger: [SE record IDs] Appointment accepted: [Person; date; record] Effective period and review: [Dates or events]
RO-04 — Workforce and competence planning
The role owner identifies the work that must be performed and the knowledge and practical skills needed to perform it. The NICE Framework provides a common language for documenting cybersecurity work. The owner selects relevant Work Roles and Task, Knowledge and Skill statements from the identified component release, recording the release and identifiers used. Local responsibilities that extend beyond cybersecurity remain in the register even where NICE has no direct match.
The owner assesses current competence using relevant work products, observed practice, training or other evidence appropriate to the activity. A course completion or certification can contribute evidence but is not the only measure. Gaps become development actions with an owner, planned support and completion evidence. New tooling, AI responsibilities, changed threats or a change in assigned work triggers review of the competence requirements.
RO-05 — Delegation and continuity
A delegation identifies the delegating authority, recipient, permitted decisions, scope, conditions and expiry or review. The recipient confirms acceptance. Further delegation occurs only within the authority granted. When a person leaves, changes role or becomes unavailable, the owner arranges reassignment, updates contact routes, and transfers open actions and relevant records. Access changes are coordinated with the environment and operations procedures.
Deputies receive the information and access needed to perform the continuity role when activated. Activation is recorded for decisions requiring a named authority. The role owner checks that absence arrangements work for urgent incident response, vulnerability treatment and release decisions, as well as routine reviews. A vacant assignment remains visible in reporting with its consequences and temporary arrangements.
RO-06 — Supplier and AI participation
Contracted responsibilities identify the service, responsible contact, expected work products, access, reporting arrangements and obligations retained by the organisation. The supplier owner verifies that the agreement supports those expectations. A supplier’s internal job title does not substitute for identifying who can commit the supplier to a decision or provide the required evidence.
AI tools may assist with specified tasks under the AI tool policy. The role register identifies the human or organisational owner of the resulting work and the review required before reliance. Tool permissions, analytical capability and decision authority are recorded separately. The ability to produce an answer or execute an action does not establish the authority to approve its consequences.
RO-07 — Review and assurance
At [schedule] and following personnel or scope changes, the programme owner checks that assignments remain current and acknowledged. The assurance reviewer samples completed work and confirms that the performer and decision-maker held the recorded authority at the relevant time. The review checks role capacity, competence actions, deputy readiness and unresolved conflicts. Findings are assigned to the responsible owner and tracked through corrective action.