Who should take ownership of your cyber security strategy?

A board meeting in a modern office, with everyone in the room looking at a screen showing remote working colleagues. — (Image credit: Getty Images)

In an era where digital threats are omnipresent, determining who should spearhead your organization’s cyber security strategy is no longer a theoretical exercise—it’s a business-critical decision.

According to the GOV UK Cyber Security Breaches Survey 2025/2026, 43% of businesses and 28% of charities have faced cybersecurity breaches or attacks in the past year. The numbers are even more alarming for medium-sized businesses (65%), large enterprises (69%), and high-income charities (34%).

Phishing remains the most pervasive threat for impacted organizations, affecting 93% of attacked businesses and 95% of attacked charities. While less common, other forms of impersonation and malware attacks still contribute to the growing risks. The financial toll is significant: recent research from the cybersecurity firm ESET found cyber attacks cost UK businesses £64 billion per year.

With such high stakes, the question isn't just about the necessity of a robust cybersecurity strategy but also about accountability. Who within your organization should be responsible for safeguarding against these ever-evolving threats? From leadership and IT teams to third-party specialists, the answer may depend on your organization’s size, structure, and resources.

Who is responsible for your cybersecurity strategy?

The digital landscape is fraught with challenges, and organizations face relentless cyber threats. With hackers targeting such high rates of businesses each year, the stakes have never been higher. As these threats grow in scale and sophistication, determining who should take ownership of your cybersecurity strategy becomes a pivotal decision.

Ownership of a cybersecurity strategy should align with the organization’s size, industry, and risk tolerance. For smaller companies, an IT manager may oversee cybersecurity efforts. However, as organizations grow, a more structured approach is necessary.

Durgan Cooper, director at CETSAT, emphasizes the importance of a senior executive or board member taking ultimate responsibility. “Clear, top-level ownership is essential,” he explains, noting that this leader must coordinate efforts across IT, leadership, and external partners while ensuring alignment with corporate goals.

In larger enterprises, the chief information security officer (CISO) typically assumes this role, supported by other executives such as the CIO. Spencer Summons, founder of Opliciti, stresses the importance of appointing a cybersecurity leader who understands threats, communicates effectively with the board, and integrates cybersecurity into broader business objectives. For sectors with strict compliance demands, such as healthcare or finance, regulatory requirements further necessitate executive oversight. “The cybersecurity leader is responsible for defining the threat to the organization, identifying the risk and building a proportionate and effective cyber security capability,” he tells ITPro.

Cybersecurity is not the responsibility of one individual or department: it's a collaborative effort involving IT, executive leadership, and external partners.

Matthew Riley, European head of Information Security at Sharp Europe, advocates for a governance framework that clearly defines roles to avoid confusion and gaps. He suggests using tools like the RACI matrix (Responsible, Accountable, Consulted, Informed) to ensure clarity. This helps organizations balance technical safeguards implemented by IT with strategic oversight provided by leadership.

However, striking the right balance can be challenging. Assigning responsibility too narrowly – such as leaving it solely to IT – risks blind spots and misalignment with business goals. Conversely, overly broad responsibility dilutes accountability, slowing decision-making and leaving vulnerabilities unaddressed. "Cybersecurity should be everybody's responsibility," says Summons, advocating for a culture integrating security into all business functions.

As cyber attacks become increasingly frequent and sophisticated, the burden on cybersecurity professionals has reached unprecedented levels. From IT managers to CISOs, many struggle with stress and burnout as they strive to defend organizations against relentless threats. Spreading the responsibility for cybersecurity across the entire business is not only a strategic move to bolster defences – it’s also an effective way to ease the strain on those directly responsible for security.

A culture of shared responsibility starts at the top. Leadership must communicate that cybersecurity is a core business issue, not just an IT problem. By embedding security into all departments and functions, organizations can foster a collective mindset where every employee plays a role in safeguarding the business.

"Cybersecurity isn't just the security team's job – it's everyone's," says Thom Langford, EMEA CTO at Rapid7.

When employees across all levels of the organization are engaged, the load becomes lighter for those traditionally tasked with defending against attacks.

Burnout among cybersecurity professionals has been exacerbated by the rise in cyber attacks, leaving teams overwhelmed and at risk of missing critical threats. A collaborative approach helps distribute the workload, ensuring that no single team or individual bears the brunt of this immense responsibility.

Spreading cybersecurity responsibility across the business isn't just about reducing burnout, it's a strategic investment in long-term resilience. When everyone understands their role in protecting the organization, it creates a united front against external threats. This approach ensures that cybersecurity isn't siloed but integrated into the organization's fabric, making it stronger and more adaptable in the face of evolving challenges.

The role of the board

The C-suite is critical in shaping and overseeing an organization's cybersecurity strategy. CISOs and CIOs often lead these efforts, but the CEO and other executives must actively champion and support initiatives.

Rich Seiersen, chief risk technology officer at Qualys, argues that CISOs should report directly to the CEO or board to avoid filtering decisions through a CIO and ensure a business-aligned risk management approach. For companies without a dedicated CISO, this responsibility often falls to external security firms or IT leaders with direct access to the executive team.

A proactive C-suite ensures that cybersecurity isn’t siloed as an IT issue but integrated into broader business strategies. Langford warns against treating cybersecurity as a peripheral concern: “When leadership treats it as a siloed issue, it’s bound to fail,” he asserts. Instead, he calls for embedding security into every department, making it a core business objective.

Your cybersecurity mix

Outsourcing can effectively address gaps in expertise and resources, but it comes with potential pitfalls. Summons highlights risks such as losing control over security measures, compliance issues, and cyber vendor reliability. He advises organizations to conduct due diligence, establish clear service-level agreements (SLAs), and continuously monitor vendor performance.

While outsourcing can enhance security capabilities, it should never replace internal oversight. Summons and others recommend maintaining strategic control to ensure alignment with business goals. “Outsourcing works best when external consultants work closely with your team to build a tailored strategy,” says Langford.

The question of who should take ownership of a cybersecurity strategy has no one-size-fits-all answer. Effective ownership involves clear accountability at the top, supported by a collaborative approach across departments and partners. Organizations must ensure cybersecurity strategies are aligned with business objectives, adequately resourced, and continuously monitored.

Ultimately, cybersecurity is a technical and business issue requiring constant attention and adaptation. As CETSAT’s Cooper aptly puts it, "It's an ongoing journey." Whether ownership rests with a CISO, a board member, or a collaborative team, the goal remains to protect the organization's assets, reputation, and future. By fostering a culture of shared responsibility, organizations can build resilience against the ever-evolving threat landscape.

TOPICS

Sandra Vogel is a freelance journalist with decades of experience in long-form and explainer content, research papers, case studies, white papers, blogs, books, and hardware reviews. She has contributed to ZDNet, national newspapers and many of the best known technology web sites.

At ITPro, Sandra has contributed articles on artificial intelligence (AI), measures that can be taken to cope with inflation, the telecoms industry, risk management, and C-suite strategies. In the past, Sandra also contributed handset reviews for ITPro and has written for the brand for more than 13 years in total.

With contributions from