Name a specific role that owns security decisions, a deputy, and the executive they report to. A title like CISO is not required for the answer to be credible. What matters is that a real person has the authority, the time and a regular cadence for reporting, and that you describe that arrangement without inflating it.
What the question tests
When a reviewer asks "who is responsible for information security?", they want to know whether anyone can make a decision, whether it is someone's actual job, and whether leadership sees the results. An empty box or a vague "the whole team" suggests nobody does.
Common small company arrangements
| Arrangement | How to describe it truthfully |
|---|---|
| CTO owns security | The CTO is accountable, with an engineering lead as deputy |
| Head of engineering plus part time advisor | Accountable role stated, external advisor named by function |
| Security engineer reporting to CTO | The role, its scope and the reporting line |
| Founder owns it | Say so, and name the delegate for daily operations |
Do not describe a part time or advisory arrangement as a full time team. Say what it is.
Build the answer
- State the accountable role and what decisions it holds: policy approval, risk acceptance, incident leadership.
- Name a deputy, so absence does not stop decisions.
- Describe the reporting line to the executive team and how often security is reviewed, such as monthly.
- List supporting roles: engineering owns secure development, IT or operations owns access, people operations owns onboarding and offboarding.
- Mention external help by function, such as an independent tester or advisor, without implying they run your security.
Example wording
"Security is owned by our CTO, who approves policies, accepts risks and leads incident response. A senior engineer is the named deputy. Security is reviewed with the leadership team monthly. Access management sits with operations, and secure development with engineering."
Make it true
Write a one page security responsibilities document and date it. Without it, the answer is a claim. With it, you can attach evidence. The document should include decision rights, the monthly agenda, the escalation route and the list of owners for each major control area.
Check the time commitment too. If the accountable person spends an hour a month on security, say it honestly in internal planning even if you do not publish the figure. A reviewer probing detail will find out.
What not to write
- A CISO title given only for the questionnaire.
- "Dedicated security team" when it is two people with other jobs.
- "24/7 security monitoring" without a rota or contract that proves it.
- Names of individuals who have left.
Keep it current
Review the document each quarter and whenever someone changes role. Update your answer library, trust page and sales claims sheet on the same day. A stale owner name is one of the easiest ways for a reviewer to see that records are not maintained.
When to hire or contract
If reviews keep exposing the same gaps, the cause is often capacity, not intent. Track how many hours the questionnaire programme takes each month. That figure is the case for a dedicated hire or a fractional arrangement, which you can put to leadership with real data.
Where Safeguard fits
Safeguard's compliance and evidence automation can hold control owners, review dates and supporting records in one place, which helps a small team show who owns what. A free scan is available at https://gold.safeguard.sh/scan.
Quick check
Do we need a CISO to pass a security review?
No. Reviewers look for a named accountable role with authority and a regular reporting rhythm.
Can we list an external advisor as responsible?
Accountability stays inside the company. You can mention the advisor by function as support.
Last reviewed: 19 October 2026.
