Who decides what: a RACI for cybersecurity decisions
After an incident, the most uncomfortable question isn’t technical: it’s who was supposed to decide, and didn’t.
In most companies, security decisions get made by habit rather than by structure: whoever has always approved certain exceptions keeps doing so, whoever has the most technical experience ends up deciding on matters that would deserve a higher-level approval. It works until something happens — and then the question "who was supposed to decide this?" has no clear answer, because it was never written down.
Why a RACI helps more than an org chart
An org chart tells you who reports to whom. A RACI (Responsible, Accountable, Consulted, Informed) tells you who decides what, on which categories of risk, and who at minimum needs to be told. Applied to the most recurring security decisions — accepting a residual risk, approving a policy exception, authorising a critical supplier, deciding whether an incident is "significant" for NIS2 purposes — it turns a grey area into a named responsibility.
The value isn’t bureaucratic. It’s that when a decision needs to be made quickly — and in security that happens often — the people involved already know who has the authority to approve it, instead of finding out while the clock is running.
Where it usually breaks
The most fragile point is almost always the exception: policy says one thing, but the business needs another, and someone needs explicit authority to approve the deviation — with a recorded reason, not just an email lost in an inbox. Without this, exceptions pile up informally, and become the biggest risk no one ever formally approved.
The takeaway
A cybersecurity RACI doesn’t remove hard decisions. It removes the ambiguity about who has to make them — and when an incident hits, that is often the difference between a fast response and hours lost figuring out who gets to say yes.
