Organizational structures, roles and responsibilities (board, steering committee, CISO, data owners)

Security works only when people know who decides, who does the work and who checks it. CISM expects you to know the standard roles and where accountability sits. The board of directors sets overall direction and risk appetite and oversees management; it is ultimately accountable for protecting the organization's assets. Executive management, led by the chief executive officer (CEO), turns that direction into strategy, funds it and makes sure the organization carries it out. Board committees, such as an audit committee or a risk committee, often receive security reports on the board's behalf.