Purpose
This matrix defines information security roles and responsibilities across the organisation, ensuring accountability and clarity for ISMS implementation and maintenance.
Role Structure
Note: In a small team, individuals may hold multiple roles. This matrix defines responsibilities, not necessarily separate people.
Current state: As a sole operator, the Founder currently holds all roles defined below. Role definitions are maintained for future team growth and to satisfy ISO 27001 requirements for documented responsibilities.
Executive Roles
ISMS Owner
Overall ISMS accountability and strategic direction
| Responsibility | Description | Frequency |
|---|---|---|
| ISMS Leadership | Demonstrate leadership and commitment to ISMS | Ongoing |
| Policy Approval | Approve information security policies and major changes | As needed |
| Resource Allocation | Ensure adequate resources (budget, staff, tools) for security | Annually |
| Management Review | Chair quarterly management review of ISMS | Quarterly |
| Risk Acceptance | Accept residual risks after treatment | Quarterly |
| External Reporting | Report to stakeholders on security posture | As needed |
| Certification | Sponsor ISO 27001 certification process | When commercially justified |
Authority: Final decision on all security matters
Reports to: Board / Stakeholders
Skills: Strategic thinking, risk management, compliance knowledge
Operational Roles
Security Lead
Day-to-day ISMS implementation and security operations
| Responsibility | Description | Frequency |
|---|---|---|
| ISMS Maintenance | Maintain and update ISMS documentation | Ongoing |
| Risk Management | Conduct risk assessments, maintain risk register | Quarterly |
| Incident Response | Lead security incident response | As needed |
| Access Control | Manage access to critical systems (Cloudflare, GitHub) | Ongoing |
| Audit Coordination | Coordinate internal and external audits | Annually |
| Cryptographic Key Management | Generate, store, rotate signing and HMAC keys | Per schedule |
| Security Monitoring | Monitor security logs, vulnerability scans, alerts | Daily |
| Supplier Management | Assess and monitor critical suppliers (Cloudflare, GitHub) | Quarterly |
| Policy Implementation | Implement security policies and procedures | Ongoing |
| Training Coordination | Ensure team completes security awareness training | Onboarding + Annual |
| Compliance Monitoring | Track compliance with policies and controls | Ongoing |
| Metrics Reporting | Collect and report security metrics | Monthly |
Reports to: ISMS Owner
Skills: Information security, cryptography, cloud security, incident response
Developer
Secure development and operational security
| Responsibility | Description | Frequency |
|---|---|---|
| Secure Coding | Follow secure development practices | Daily |
| Code Review | Review code for security issues before merge | Per PR |
| Security Testing | Run security scans, fuzzing, static analysis | Per PR |
| Dependency Management | Monitor and update dependencies for vulnerabilities | Weekly |
| Change Management | Follow change management procedures | Per change |
| Incident Support | Support Security Lead during incidents | As needed |
| Configuration Management | Maintain secure configurations (wrangler.toml) | Per change |
| Documentation | Document security-relevant architecture and code | Ongoing |
| Security Tools | Use approved security tools (MFA, password manager) | Daily |
| Reporting Issues | Report security concerns or incidents immediately | As needed |
Reports to: ISMS Owner
Skills: Secure coding, cryptography libraries, testing, DevSecOps
Specialized Responsibilities
Cryptography Specialist
Cryptographic implementation and key lifecycle
| Responsibility | Description | Frequency |
|---|---|---|
| Algorithm Selection | Choose and approve cryptographic algorithms | As needed |
| Key Generation | Generate cryptographic keys securely | Per rotation |
| Key Storage | Ensure secure storage of signing and HMAC keys | Ongoing |
| Key Rotation | Rotate keys per schedule or on compromise | Annually |
| Key Backup | Maintain encrypted offline backups | Per rotation |
| JWKS Management | Publish and update verification keys | Per rotation |
| Key Status Management | Maintain key lifecycle status (Active -> Deprecated -> Disabled) | Ongoing |
| Cryptographic Review | Review crypto code changes for correctness | Per PR |
Authority: Approve all cryptographic implementation changes
Skills: Applied cryptography, ZKP, elliptic curves, key management
Compliance Officer
Regulatory and standards compliance
| Responsibility | Description | Frequency |
|---|---|---|
| Privacy Compliance | Ensure Australian Privacy Act compliance | Ongoing |
| ISO 27001 Compliance | Maintain ISMS per ISO 27001:2022 requirements | Ongoing |
| Audit Preparation | Prepare evidence for internal and external audits | Quarterly |
| Policy Updates | Update policies for regulatory changes | As needed |
| Documentation | Maintain compliant records and documentation | Ongoing |
| Training Records | Track and report security training completion | Quarterly |
Authority: Interpret compliance requirements, recommend changes
Skills: ISO 27001, privacy law, audit processes
RACI Matrix
Responsible | Accountable | Consulted | Informed
ISMS Management
| Task | ISMS Owner | Security Lead | Developer | External Auditor |
|---|---|---|---|---|
| ISMS Policy Approval | A | R | C | - |
| ISMS Documentation | A | R | C | - |
| Management Review | A/R | R | I | - |
| Internal Audit | A | R | I | - |
| External Audit | A | R | C | R |
Risk Management
| Task | ISMS Owner | Security Lead | Developer |
|---|---|---|---|
| Risk Assessment | A | R | C |
| Risk Treatment Plan | A | R | C |
| Risk Acceptance | A/R | C | I |
| Risk Monitoring | I | R | I |
Incident Response
| Task | ISMS Owner | Security Lead | Developer |
|---|---|---|---|
| Incident Detection | I | R | R |
| Incident Response | A | R | R |
| Incident Reporting | I | R | R |
| Post-Incident Review | A | R | C |
Access Control
| Task | ISMS Owner | Security Lead | Developer |
|---|---|---|---|
| Access Provisioning | A | R | I |
| Access Review | A | R | I |
| Access Revocation | A | R | I |
| MFA Enforcement | A | R | R |
Cryptographic Operations
| Task | ISMS Owner | Cryptography Specialist | Developer |
|---|---|---|---|
| Algorithm Selection | A | R | C |
| Key Generation | A | R | - |
| Key Storage | A | R | - |
| Key Rotation | A | R | I |
| Crypto Code Review | I | R | C |
Secure Development
| Task | ISMS Owner | Security Lead | Developer |
|---|---|---|---|
| Secure Coding | A | C | R |
| Code Review | I | C | R/A |
| Security Scanning | I | C | R |
| Dependency Updates | I | C | R |
| SLSA Compliance | A | R | R |
Training
| Task | ISMS Owner | Security Lead | Developer |
|---|---|---|---|
| Training Content | A | R | C |
| Training Delivery | I | R | R (self-paced) |
| Training Records | I | R | - |
All Staff Responsibilities
Every team member, regardless of role:
- Understand and comply with information security policies
- Complete security awareness training (onboarding + annual)
- Report security incidents or concerns immediately
- Protect credentials (use password manager, enable MFA)
- Follow acceptable use policy for workstations and accounts
- Respect information classification (don’t share Restricted data)
- Ask Security Lead if unsure about security requirements
- Contribute to security culture and continuous improvement
Role Assignment
Current Assignments (as of February 2026):
| Role | Assigned To | Backup |
|---|---|---|
| ISMS Owner | Founder | - |
| Security Lead | Founder (sole operator) | - |
| Developer | Founder (sole operator) | - |
| Cryptography Specialist | Founder (sole operator) | - |
| Compliance Officer | Founder (sole operator) | - |
| Incident Response Lead | Founder (sole operator) | - |
| Audit Coordinator | Founder (sole operator) | - |
Note: As a sole operator, the Founder currently holds all defined roles. Role definitions are maintained for future team growth, and named assignments will be updated as roles are filled. Role assignments are available for auditor review upon request.
Delegation of Authority
ISMS Owner may delegate day-to-day activities to Security Lead, but retains accountability for:
- Final approval of policies
- Risk acceptance decisions
- Resource allocation
- Management review outcomes
Security Lead has authority to:
- Implement security controls
- Respond to security incidents
- Revoke access in emergency
- Update non-policy procedures
- Coordinate audits
Security Lead must escalate to ISMS Owner:
- Major incidents (P0/P1)
- Major policy changes
- Significant risks
- Resource constraints affecting security
- Findings from audits requiring management decision
Competence Requirements
ISMS Owner
Required:
- Understanding of ISO 27001 requirements
- Risk management knowledge
- Strategic leadership experience
Desirable:
- Information security certification (CISSP, CISM)
- Experience with ISMS implementation
Security Lead
Required:
- Information security technical knowledge
- Cryptography fundamentals
- Cloud security (Cloudflare Workers)
- Incident response experience
- ISO 27001 familiarity
Desirable:
- Security certification (CISSP, OSCP, CEH)
- Zero knowledge proof understanding
- Previous audit experience
Developer
Required:
- Secure coding practices
- Understanding of OWASP Top 10
- Version control (Git) and code review
- Dependency management
Desirable:
- Security testing (fuzzing, static analysis)
- Cryptography libraries experience
Training provided: Security awareness, secure coding workshops, ZKP specifics
Role Changes
When roles change (new hire, departure, restructure):
- Update this matrix
- Update Asset Register (ownership changes)
- Review and update access (provisioning or revocation)
- Transfer knowledge (documentation, handover meeting)
- Update audit plans (if auditor changes)
- Notify in management review
Documented: Within 5 business days of change
Related Documents
- Information Security Policy - Overall accountability
- Access Control Policy - Access provisioning roles
- Incident Response - Incident roles
- Internal Audit - Audit roles
Document Information
- Version. 2.0
- Effective Date. 2025-01-13 (initial), 2026-02-16 (updated)
- Owner. ISMS Owner
- Review Frequency. Annually (or when roles change)
- Next Review. 2027-01-13
- Classification. Public