How should security roles and responsibilities be documented to satisfy Annex F requirements?

• A. Assign responsibilities verbally and not record them
• B. Define responsibilities, accountability, and escalation paths in governance documents and SSP
• C. Use generic job titles without specific duties
• D. Leave roles undefined to maintain flexibility

Answer: (B)

Annex F requires explicit, formal documentation of who is responsible for each security control, who is accountable for outcomes, and how issues are escalated. Recording these in governance documents and the System Security Plan creates a traceable responsibility map that supports accountability, consistent decision-making, and efficient incident handling. Verbal assignments lack evidence and can drift; using only generic job titles without defined duties leaves gaps in responsibility and makes it hard to audit or enforce controls. Leaving roles undefined breaks governance and compliance. So the best approach is to define responsibilities, accountability, and escalation paths in governance documents and the System Security Plan.