角色与职责
定义网络安全角色、职责和权限。
角色与职责由以下 NIST CSF 2.0 成果定义：GV.RR-01 (Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving); GV.RR-02 (Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced); GV.RR-03 (Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies)。 对照映射 通过 ISO 27001, PCI DSS, 800-53, HIPAA 和 NIS2 中已发布的对照表完成映射。 编辑说明 在 SOC 2, GDPR, DORA 和 CPS 234 中经编辑映射。 在 CIS v8.1 中仅弱相关。 本站数据中无映射 本站数据中 CMMC, Essential Eight 和 Cyber Essentials 无映射。
| 框架 | 要求 | 标题 | 链接 | 来源 / 原因 |
|---|---|---|---|---|
| NIST CSF 2.0 | GV.RR-01GV.RR-02GV.RR-03 | Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving; Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced; Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies | 主题定义 | GV.RR-01 GV.RR-02 GV.RR-03 |
| ISO 27001 | A.5.2A.5.4 | Information security roles and responsibilities; Management responsibilities | 对照映射 | A.5.2: via GV.RR-02; NIST 800-53 map: PM-2, PM-29 A.5.4: via GV.RR-01 |
| CIS v8.1 | CIS 14.1CIS 14.9 | 未映射到此主题 | 这些要求仅通过已发布的交叉映射与本主题的 CSF 成果（GV.RR-01, GV.RR-02, GV.RR-03）存在关联：值得核查，但不构成映射。 | |
| SOC 2 | CC1.3CC1.2CC1.5 | Structures, reporting lines, authorities and responsibilities; Board independence and oversight of internal control; Accountability for internal control responsibilities | 编辑说明 | AICPA's TSC mappings are not openly licensed; ControlMapping editorial mapping (criterion summaries are ours, not AICPA text). |
| PCI DSS | 12.1.312.1.4 | Security roles and responsibilities defined; Executive responsibility for information security assigned | 对照映射 | 12.1.3: via GV.RR-01; GV.RR-02 12.1.4: via GV.RR-01; GV.RR-03 |
| CMMC | — | 无要求 | 本站数据中无映射 | 本站数据中没有 CMMC 要求映射到此主题。 |
| 800-53 | PM-2PS-9PM-29 | Information Security Program Leadership Role; Position Descriptions; Risk Management Program Leadership Roles | 对照映射 | PM-2: via GV.RR-01; GV.RR-02 PS-9: Position descriptions must state security and privacy roles and responsibilities; NIST links PS-9 only to GV.RR-04 (HR practices), but it is the 800-53 control that writes roles down. PM-29: via GV.RR-01; GV.RR-02 |
| HIPAA | §164.308(a)(2) | Assigned Security Responsibility | 对照映射 | §164.308(a)(2): via NIST HIPAA map: PM-2 |
| GDPR | Art.37(1)Art.39(1) | Designation of the data protection officer; Tasks of the data protection officer | 编辑说明 | No official crosswalk exists for GDPR; ControlMapping editorial mapping. |
| NIS2 | 1.2 | Roles, responsibilities and authorities | 对照映射 | 1.2: via GV.RR-02; ENISA ISO map: A.5.2, A.5.4 |
| Essential Eight | — | 无要求 | 本站数据中无映射 | 本站数据中没有 Essential Eight 要求映射到此主题。 |
| DORA | Art.5(2)(c)Art.6(4)Art.5(3) | Governance and organisation; ICT risk management framework; Governance and organisation | 编辑说明 | Art.5(2)(c): The management body sets clear roles and responsibilities for all ICT-related functions. Art.6(4): An independent control function manages and oversees ICT risk, with segregated risk, control and audit functions. Art.5(3): A role, or a senior manager, monitors arrangements with ICT third-party service providers. |
| CPS 234 | Para 13Para 14 | Board ultimately responsible for information security; Define information security roles and responsibilities | 编辑说明 | Para 13: The Board is ultimately responsible for information security. Para 14: Clearly define information security roles and responsibilities, from the Board to operations. |
| Cyber Essentials | — | 无要求 | 本站数据中无映射 | 本站数据中没有 Cyber Essentials 要求映射到此主题。 |
主题定义 定义本主题的 CSF 2.0 结果 · 对照映射 至少一项选择有已发布对照表作为依据 · 编辑说明 ControlMapping 的判断及理由 · 未映射，仅与该主题的 CSF 成果相同 · 本站数据中无映射 我们的数据中未映射任何内容；通常为新工作，但请查看覆盖范围说明. 方法说明.
要求编号和标题均按各框架官方发布的英文原文显示。
映射有误或缺失？ 报告
关于角色与职责
明确界定的网络安全角色和职责有助于落实问责机制，避免整个组织的安全防护出现空白。这包括指定首席信息安全官（CISO）或同等职级的负责人、明确系统负责人的安全职责、设立安全委员会，以及记录安全决策的升级路径。在事件处置期间，角色划分是否清晰尤为关键：如果权限归属不明确，可能会延误响应时间，并扩大损害范围。