When a software company has no security team, one named person should be accountable for security outcomes, usually the CTO or VP Engineering or a delegate they pick. Engineering managers own fixes in their teams, and a platform or DevOps lead owns tooling. Write the split down so it survives busy weeks.
Why "everyone owns it" fails
The phrase is true in spirit and useless in practice. When a critical finding appears on Friday, "everyone" means nobody has the authority to delay a release or to pull an engineer off a feature.
CISA's performance goals treat this as a basic outcome: a single leader responsible and accountable for cybersecurity, with a named role or title responsible for planning, resourcing and execution. The goal text adds that the role may manage operations at a senior level, secure budget, or lead strategy. Notice that it says a role, not a headcount.
A simple ownership split
| Area | Accountable | Does the work |
|---|---|---|
| Security outcomes and tradeoffs | CTO or VP Engineering (or named delegate) | The same person, with advice |
| Fixing findings in a service | Engineering manager of that service | Developers on that team |
| Scanner and gate configuration | Platform or DevOps lead | Platform engineers |
| Identity and access basics | IT or platform lead | IT or platform |
| Customer questionnaires | Named owner or sales engineering | Whoever knows the control |
| Incident decisions | Named incident lead on call | Responders |
Adjust the names, keep the shape. The key column is "Accountable", because it is where escalation lands.
What the named owner actually does
- Keeps the one page plan and updates it quarterly.
- Chairs a short weekly review of open findings.
- Decides on exceptions, with an expiry date on each.
- Speaks for security in roadmap and hiring talks.
- Holds the contact list for incidents.
If this takes more than a day a week at your size, that is evidence for a dedicated hire. If it takes an hour, the role is working as designed.
Failure patterns to avoid
- The owner is also the busiest developer. Their security work will slip first.
- The owner has no authority. If they cannot delay a release, the title is decoration.
- The split lives in someone's head. Put it in the engineering handbook.
- The owner never changes. Plan a handover so vacation does not freeze decisions.
Document it in one paragraph
A short statement is enough: who is accountable, who covers when they are away, where findings are tracked, and how to reach them. Link it from the onboarding checklist so new engineers see it in week one.
Safeguard's asset discovery and policies features give the owner a current list of what exists and a way to encode decisions as gates, so the accountability has something to act on. You can try the free scan to see what an inventory view looks like.
Quick check
Can the CTO be the security owner at a 40 engineer company?
Yes, and it is common. The risk is time, so name a delegate and set a weekly slot.
Is a security champion the same as an owner?
No. Champions help inside teams. The owner is accountable across the company and holds decision rights.
Sources
- CISA Cybersecurity Performance Goals (archived page that points to a newer version)
Last reviewed: 19 October 2026.
