8. Which security responsibilities should remain inside the business?

Suggested experts: Arvin Bansal and Daniel Eliot. Why it matters: outsourcing delivery does not remove the need for a business decision maker.

Context: Bansal's business-oriented discussion and NIST's implementation session offer different perspectives.

Good-answer framing — editorial: identify ownership of risk acceptance, access approval, business interruption, critical-service priorities and honest representations to customers or insurers. Explain the minimum knowledge an internal owner needs to oversee the service. Address the problem of the one indispensable administrator.

Follow-up: “What should be delegated in writing, and what should executives remain prepared to decide?”