Control ownership

I've been assigned ownership of a control, what now?

As a control owner, it is your responsibility to make sure the control that you own is designed and operating effectively. In other words, you need to make sure the control addresses a specific risk or objective, and that the control is functioning as intended. You are responsible for oversight of the control, and communicating issues to management if the control is not operating effectively.

Once you've been assigned ownership of a control, you'll need to complete the following steps:

• Edit the wording of the control to reflect your company's current process accurately.

• Set the progress flag on the control to "Not in Place," "Partially in Place," or "In Place," depending on how mature your process for the given control activity is.

• Activate evidence and assign evidence owners to the recommended items pre-linked to the control (you can also create custom evidence if the provided examples don't cover your unique control).

Edit the control wording

Your first step will be to review the wording and language for the control that has been assigned to you. All controls within Strike Graph are editable, and the default control wording is template language that is meant to be changed to fit your company's process. When it comes time to complete your audit, the auditor will be looking to make sure that you have been living up to the specific process described in the control, so the actual wording used is important. For example, if a control states that you are performing user access reviews quarterly, when in reality you are completing the task annually, the best case is that the auditor will require you to change the control language.

Set the progress flag

The next step after editing the language is to set the control progress flag to "In Place," "Partially in Place," or "Not in Place." Progress flags should be based on how close to operational (or "audit ready") your process for a given control is.

Looking at the evidence items linked to the control can give you a good idea of what the auditors are expecting to see for a given control.

Assign evidence owners

The last step is to activate and assign owners to the evidence items linked to the control. Evidence owners are responsible for gathering and uploading the necessary policy or screenshot needed to satisfy an evidence request. They are also responsible for configuring any integration from the actual evidence item to Strike Graph. The evidence owner could be the same person as the control owner, or this could be a different person. To read more about evidence ownership, click here.

How should I assign ownership of controls that do not have owners assigned?

Every control is required to have a control owner. Ownership of controls should be assigned to the individual at your company who has the authority and responsibility for the control. In some cases, especially within smaller organizations, the person performing the control is the same as the individual with ownership of the control. In larger organizations, it may be appropriate for the control owner and the control operator to be different people. For example, security monitoring tasks may be carried out by a security analyst, but in reality, the responsibility for ensuring monitoring is in place and effective lies with the CISO. In this case, the CISO should be the control owner. Check out this article for more information on control owners vs control performers.

In a small organization, it is appropriate to have controls assigned to a few people, but as your business grows and matures, it is important to revisit control ownership to ensure responsibility is still defined appropriately.

Questions?

Reach out through our chat feature for real-time Customer Success support 8 am - 5 pm PT Monday through Friday.