According to the CRISC Review Manual (Digital Version), the security management function is responsible for ensuring that effective cybersecurity controls are established and maintained. The security management function should:
Define the cybersecurity strategy and objectives aligned with the enterprise’s risk appetite and business goals
Establish and maintain the cybersecurity policies, standards, procedures and guidelines
Implement and monitor the cybersecurity controls and processes
Coordinate and communicate with other stakeholders, such as risk owners, IT management, enterprise risk function, internal and external auditors, regulators and third parties
Report on the cybersecurity performance and risk posture to senior management and the board
Continuously improve the cybersecurity capabilities and maturity
References = CRISC Review Manual (Digital Version), Chapter 1: IT Risk Identification, Section 1.4: IT Risk Management Roles and Responsibilities, pp. 29-301
