164.308(a)(2) Assigned Security Responsibility (Standard)
Administrative safeguard · Standard
The requirement as we hold it
Assigned Security Responsibility (Standard). Identify the security official responsible for development and implementation of policies and procedures. NIST recommends a documented appointment, position description, and reporting line to executive leadership.
The examiner asks
- Name the security official responsible for these policies, and show me the appointment.
- Where does that role report, and does the reporting line reach executive leadership?
Evidence to bring
- the written appointment
- the role's position description
Source: 164.308(a)(2) at eCFR. Our statement of the clause, not the instrument verbatim.