Who should own cyber security risk for an AI service under Secure by Design?

Answered

Assign senior risk owners with the experience, knowledge and authority to lead security activities across the service life cycle. Make cyber security a senior leadership consideration and resource it appropriately.

From the guidance

Primary (how) Secure by Design Principles

Assign risk owners to be accountable for managing cyber security risks for a service throughout its life cycle. These must be senior stakeholders with the experience, knowledge and authority to lead on security activities.

Section: 1. Create responsibility for cyber security risk

Read this in Secure by Design Principles (opens in new tab)

Related questions

• What is continuous assurance under Secure by Design?
• How do teams evidence Secure by Design?
• Is Secure by Design mandatory for government AI services? Security and safe use of tools
• Do staff need AI-specific cyber security training?
• How should commercial teams apply Secure by Design when buying AI? Buying and building