Research and interviews show that CISO’s in cities may be held accountable for systems that they do not have direct control over, as these may be procured or managed by departments other than central IT functions. Accountability sits best within a single person’s domain, however, changing governance structures within cities takes time and single-person accountability might be something to work towards. This policy is written for single-person accountability, however, an interim step may be to have a model of shared accountability in place between a central IT team/CISO’s office and operations departments.
Cities have the flexibility to implement this accountability model in different ways, and accountability could sit with multiple senior officers as long as all of the responsibilities are covered and cities can show who ultimately has responsibility for each of these areas. These roles (if more than one) should have a clearly defined level of cooperation/coordination to ensure that all responsibilities are shared between them and regular updates take place, including but not limited to: key performance indicators (KPIs), associated schedule of authority amongst domains and a clear escalation hierarchy.
This policy could be a published internal or external policy document, and/or the basis for one or more job descriptions for those accountable for cybersecurity in the city.
Intro Video to the Cyber Accountability Model