3LoD and cybersecurity

So far, we have looked at the 3LoD model from an overarching view of enterprise risk management. In this section, we will translate those responsibilities for cybersecurity functions.

Please be aware that an official 3LoD and cybersecurity model is not mainstream, but the following figure should give you a good sense of the responsibilities for each role:

Figure 4.3 – 3LoD and cybersecurity responsibilities

In the preceding figure, we can see that the first LoD is doing the on-ground work and owns the responsibilities of the operational management of technical activities such as conducting penetration tests and vulnerability assessments, restricting user access rights, and more.

The second LoD is focused on performing oversight and monitoring in the form of documenting the policies/standards/procedures as per the business objectives, conducting access reviews, planning and conducting the Business Continuity Planning...