About

Responsibilities is where you record who is accountable for compliance. The page is called Roles and Responsibilities and has two tabs:

• Roles: name the people who hold security roles, such as System Owner or Authorizing Official, for your whole organization or for one framework.
• Responsibility Matrix: for each objective in a framework, write down what each of up to five named parties is responsible for.

The two tabs are separate. A party in the matrix is a name you choose, not a person from your People list, and a security role is not a matrix party.

Super Admins and Compliance Managers set this up.

Open Roles and Responsibilities

1. Choose a framework in the left navigation.
2. Under that framework, select Responsibilities.
3. Select the Roles or Responsibility Matrix tab.

The matrix belongs to a single framework. If you have All Frameworks selected, the matrix asks you to choose a framework from the left navigation first.

Assign security roles

The Roles tab lists every assignment of a person to a security role. Each row shows one person in one role, so a person can appear more than once and a role can have several people.

Each row has these columns:

• Employee: the person's name. Select it to swap in a different employee.
• Department
• Role: one of Information Owner, System Owner, System Security Officer, Management Point Of Contact, Technical Point Of Contact, Authorizing Official or Additional Point Of Contact.
• Assigned scope: Organization level, or one of your frameworks.

Organization level applies to every framework. Choosing a framework applies the assignment to that framework only. With one framework selected, the list shows that framework's assignments plus the organization-level ones, and the line at the bottom reads "Showing effective assignments for" followed by the framework name.

To find an assignment, type in Search employees or roles, or select Filter and filter by Role or by Assignment level (Framework level or Organization level). The list shows 25 rows per page; use Rows per page, Previous and Next to move through it.

Give a person a security role

1. On the Roles tab, select Role.
2. In the new line that opens, pick the role, pick the assigned scope (Organization level or a framework), and search for the employee.
3. Select Save. You can also press Cmd+Enter. Select Cancel or press Esc to close without saving.

You must choose an employee before you save. If the person you search for is not an employee yet, you see "is not an employee" next to their name and an Add employee button that opens a form to create them. If the person already holds that role at that scope, the assignment is refused.

Change or remove a role assignment

Changes in the list save as soon as you make them, and a message confirms each one:

• To change the person, select their name in the Employee column and pick another employee.
• To change the role, use the drop-down in the Role column.
• To change the scope, use the drop-down in the Assigned scope column.
• To remove an assignment, select the three dots at the end of the row, then Delete. This removes the assignment, not the employee.

Use the Responsibility Matrix

The Responsibility Matrix tab has one row for each objective in the framework and five party columns. Each cell holds a short statement, in your own words, of what that party does for that objective.

The matrix shows:

• A count of responsibility mappings and a search box, Search objectives or responsibilities.
• ID: the objective's code.
• Objective: the objective's name. Use the sort arrows in the header to sort. Hover over a long name to read it in full.
• Party 1 to Party 5: the five party columns, each headed "Party N" followed by the party's name. Until you name a party, its header reads "Responsible Party N".

An empty cell shows "...". Cells show up to two lines of text; hover over a cell to read the full statement. Frameworks that group objectives under a requirement show those requirements as rows you can expand. Rows load as you scroll.

Name the responsible parties

There are always five parties per framework. You can rename them but not add or remove them. Party names apply to the whole framework, so a new name appears in that column for every objective.

1. On the Responsibility Matrix tab, select the pencil in a party's column header.
2. Type the name in Party name. A name is required.
3. Select Save. The message "Responsible party name updated." appears.

Parties are free-text names: use whatever suits your framework. They are not linked to people or users.

Write a responsibility for one objective

1. On the Responsibility Matrix tab, select the cell where the party's column meets the objective's row.
2. In the Edit responsibility window, type in Responsibility.
3. Select Save responsibility, or press Cmd+Enter (Mac) or Ctrl+Enter (Windows). The message "Responsibility updated." appears. Select Cancel to close without saving.

Write the same responsibility for many objectives

1. On the Responsibility Matrix tab, tick the rows you want. Tick the box in the header to select every row that matches your search.
2. In the bar that appears, select the button for the party, from Party 1 responsibility to Party 5 responsibility.
3. Type the text in Responsibility and select Apply responsibility. The message "Responsibilities updated." appears.

The text replaces whatever those cells held for that party.

See responsibilities on an objective

You can also work on one objective at a time. Select Objectives in the framework's left navigation, open an objective, and select its Responsibility Matrix tab.

The tab lists the five responsible parties. For each party:

• Responsible party: the party's name. Renaming a party here renames that column for every objective in the framework.
• Responsibility: the statement for this objective only. Type it and select Save responsibility.

Export responsibilities

The Roles and Responsibilities page has no export button. To get a Word document, use the Shared Responsibility Report in Reports. It is listed under the Frameworks reports as "Export Shared Responsibilities as a WORD document".