Responsibilities

• Develop information security plans aligned with business goals and objectives.
• Identify current and potential legal and regulatory requirements affecting information security.
• Identify drivers affecting the company (e.g., technology, business environment, risk tolerance, geographic location) and their impact on information security.
• Obtain senior management commitment to information security.
• Define roles and responsibilities for information security throughout the company.
• Establish internal and external reporting and communication channels that support information security.
• Establish a process for information asset classification and ownership.
• Implement a systemic and structured information risk assessment process.
• Ensure that business impact assessments are conducted periodically.
• Ensure that threat and vulnerability evaluations are performed on an ongoin...