Security roles and responsibilities, with a RACI matrix
Who owns each security activity, written down once, so every task has a name next to it.
A security roles and responsibilities document names who owns each part of the security program and who must be consulted or informed. The core of it is a responsibility matrix, one row per activity.
The full document is below with every role as a bracketed field. Put a real name next to each one before leadership approves it.
The template in full
Below is the whole document as it downloads. Every bracketed field, such as [Company name], is a detail to fill in before you adopt it. There is no form and no email address to hand over, and the file is yours to edit.
[Company name]
Security Roles and Responsibilities
- Owner
- [Security owner role]
- Approved by
- [Policy approver role]
- Effective date
- [Effective date]
- Next review
- [Next review date]
- Version
- 1.0
1. Purpose and scope
This document defines who at [Company name] (the "Company") is responsible for each part of the information security program, so that every control has an owner and nothing depends on an assumption. It covers the Company's product, the infrastructure in the production cloud environment, corporate systems, and the people who use them.
At a company of this size one person often holds more than one role. That is acceptable, provided each role has a named holder and no one approves their own access or reviews their own work.
2. Roles
| Role | Held by | Core responsibilities |
|---|---|---|
| Executive sponsor | [Policy approver role] | Sets the tone for security, approves policies and risk acceptance, provides resources, and receives security reporting at least twice a year. |
| Security and compliance owner | [Security owner role] | Runs the security program day to day: maintains policies, runs risk assessments and access reviews, leads incident response, manages the audit, and tracks remediation. |
| Engineering lead | [Engineering owner role] | Owns the security of the Company's product and the production cloud environment: secure development, change management, vulnerability remediation, logging, backups and recovery. |
| IT lead | [IT owner role] | Owns corporate systems and devices: account provisioning and removal, device encryption and updates, endpoint protection, and SaaS administration. |
| People lead | [People owner role] | Owns the people side of security: background checks, onboarding and offboarding notices, policy acknowledgments, training records and disciplinary process. |
| All personnel | Everyone | Follow Company policies, complete training, protect credentials and data, and report suspected incidents within 1 hour. |
3. Responsibility matrix
R = Responsible (does the work). A = Accountable (owns the outcome and signs off; exactly one per activity). C = Consulted (gives input before the work is done). I = Informed (told of the result).
| Activity | Frequency | Executive | Security owner | Engineering | IT | People |
|---|---|---|---|---|---|---|
| User access reviews | Quarterly | I | A | R | R | I |
| Onboarding and offboarding of accounts | Each joiner and leaver | I | A | R | R | R |
| Vendor security reviews | At onboarding, then yearly | I | A, R | C | C | I |
| Incident response | Each incident | C | A, R | R | R | C |
| Policy approval | Yearly | A | R | C | C | C |
| Risk assessment | Yearly and on major change | A | R | C | C | C |
| Vulnerability remediation | Continuous, to set timelines | I | A | R | R | I |
| Backup restore testing | At least yearly | I | A | R | I | I |
| Security awareness training | At hire and yearly | I | A, R | C | I | R |
Where one person holds two roles in the same row, a different person performs the review or approval. For access reviews, no one reviews their own access; the [Policy approver role] reviews the access of the security owner.
4. Named role holders
Write the name of the person who holds each role today and a deputy who acts when they are unavailable. Update this table within 5 business days of any change.
| Role | Name | Deputy | Date assigned |
|---|---|---|---|
| Executive sponsor | |||
| Security and compliance owner | |||
| Engineering lead | |||
| IT lead | |||
| People lead |
5. Changes and review
When a role holder leaves or changes role, the [Policy approver role] assigns a new holder before their last day, and the outgoing holder hands over open actions in writing. The [Security owner role] reviews this document at least once a year and after any change to the team structure. The [Policy approver role] approves each new version.
6. Acknowledgment
I accept the security role assigned to me in this document. I understand the responsibilities of that role and my part in the responsibility matrix, and I will tell the [Security owner role] if I can no longer carry them out.
Sign-off. Name, signature and date for: Role holder.
What an auditor checks
An auditor uses this document to decide who to interview and whose sign off to expect on each record. If the access review says one person approved it and this document names another as the owner, that mismatch becomes a question.
They also check that the roles were communicated: the people named have seen the document and accepted the role. A short onboarding note or an acknowledgment is enough. The information security policy points to this document for the detail.
Which criteria it maps to
It supports CC1.3 and CC2.2.1 A template is evidence of intent. The examination tests whether the control operated over the period, so keep the dated records the document produces. Every criterion, explained one by one, is on the Trust Services Criteria page.
Questions
What is a security RACI matrix?
Who should own security at a small startup?
Does SOC 2 require a roles and responsibilities document?
Sources
Get audit-ready without a compliance team.
The readiness assessment is free, with no payment and no card. Star is $2,000 one time to get on the platform and close your gaps. Orbit is $7,800 a year, and your SOC 2 Type 2 audit is included in every contract year. You can be audit-ready starting at about a week.
Take the free assessmentPolara Labs is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.