If the roles and responsibilities in an organisation's security process are not clearly defined, it is likely that many employees will reject or forget their responsibility for information security by pointing out that those above them in the organisational hierarchy are responsible. As a result, security safeguards will not be implemented because they almost always initially represent an additional effort on top of employees' usual work.

Kwistjonijiet marbuta

Links
is risk of ISMS.1.A1 Acceptance of Overall Responsibility for Information Security by Top Management [Top Management] (B)