Information Ownership Responsibility Matrix
Distinguishes owner, custodian and user duties for classification, access approval and retention.
Available soon
- Format
- Excel
- Size
- 63 KB
- Length
- 11 sheets
- Version
- 2.0
- Updated
What's inside
What changed
- 2.0
Rewritten to the depth of the other CISO Times packs: the 14 activities RS-01 to RS-14, each with the rule it serves, against 6 roles including the privacy and records roles, checked for one accountable role; role holders and deputies with their counts; the owner and custodian of every asset in the register; an ownership check; and the distributor's owners as the worked example.
- 1.0
Published.
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | Read the Responsibilities sheet. Each row is one activity, with the rule of the Information Classification & Handling Policy it serves; each column is a role. R does it, A answers for it (exactly one per row), C is consulted before it is done, I is told after. |
| 2 | Keep the four core roles: information owner, custodian, user, head of information security. Add the privacy and records roles where you have them; where you do not, give their letters to the role that does the work, and keep exactly one A per row. |
| 3 | On Role holders, name who holds each role in your organisation, and a deputy who acts while they are away. The counts show how many activities each role answers for, does, advises on and is told of. A deputy is bound by the same rules as the holder. |
| 4 | On Asset owners, name the owner and the custodian of every asset in the Information Asset Register. The owner is a manager in a named role, never a team (CL-03); the owner and custodian may be the same person where one person runs a system, but the owner stays accountable. |
| 5 | Clear every Check that does not say OK. The Ownership check then says the matrix is ready. Approve it with the Information Classification & Handling Policy and review it when a role holder changes, and at least once a year (CL-12). |
| 6 | Delete the EXAMPLE rows on Asset owners and replace the EXAMPLE holders before approval. The Responsibilities rows are the content itself: tailor them, do not delete them. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders. Its 17 assets have 10 owners, from the Chief Operating Officer to the Head of Marketing and Communications, and 3 custodians. The Head of Information Security owns the policy and the matrix (Executive Committee approved the policy on 14 Jul 2026).
Tailoring for a small organisation: one person may hold several roles. The Head of IT may be custodian of most systems and also hold the security role; the managing director may own most assets. Keep each activity's single A, and keep the owner and the person who checks the owner's work apart where you can.
Tailoring for a regulated entity: NIS2 and DORA expect the management body to approve and oversee the measures, and DORA expects roles and responsibilities for information assets documented (Article 8(1)). Escalations above the matrix go to the board or its equivalent.
Tailoring where a service provider runs your IT: the provider is usually the custodian of the systems it runs, under contract. It does the R work of the custodian column; the A for every activity stays inside your organisation.
Delegation: a role holder may delegate the R work to a named person, never the A. Record standing delegations in the Deputy column.
Responsibilities
R does it · A answers for it, exactly one per row · C is consulted before · I is told after. Yellow cells are yours to tailor; a blank cell means the role takes no part.
| Activity ID | Activity | Rule | Information owner | Custodian | User | Head of Information Security | Data Protection Officer | Records manager | A (calc) | R (calc) | Check (calc) | What the rule says |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| RS-01 | Classify a new or changed information asset and record the level | CL-03 | A | C | I | C | C | I | 1 | 0 | OK | Information owners approve the level and review it when the purpose, users, law, a supplier or the risk changes, within [[15]] working days of the change. |
| RS-02 | Approve a public release | CL-05 | A | I | C | C | I | 1 | 0 | OK | Public information must have an owner-approved release decision. A lack of a label never makes information Public. | |
| RS-03 | Apply labels, access and encryption in the system | CL-06 | C | A | R | C | 1 | 1 | OK | Apply the handling rule for the level to every action: storing, accessing, sharing inside and outside the organisation, transferring, printing, remote and mobile working, AI tools, retaining and disposing. | ||
| RS-04 | Grant and review access to Confidential information | CL-17 | A | R | C | 1 | 1 | OK | Access to Confidential information is granted only through an approved role profile or approved non-standard access with an expiry (P13 JML-03, JML-04), is reviewed in every access review (P07 AR-02), and administrator access to systems that hold it follows the privileged access pack (P14 PA-02, PA-06, PA-07). | |||
| RS-05 | Approve sharing Confidential information with a recipient outside the organisation | CL-08 | A | R | C | C | 1 | 1 | OK | Confidential information is shared only with an approved recipient for a recorded purpose, using an approved channel, with the recipient's address checked before sending. | ||
| RS-06 | Check a supplier before it holds Internal or Confidential information | CL-16 | A | C | R | C | 1 | 1 | OK | A supplier stores, processes or receives Internal or Confidential information only under contract terms that protect it (P06 clause CL-01, P06 clause CL-07, P06 clause CL-13, and P06 clause CL-06 where it processes personal data). Confidential information goes to a supplier only after its assessment under the third-party pack has ended in a documented decision to approve it (P06 TP-05). | ||
| RS-07 | Advise on personal and special category data | CL-07 | C | C | A | C | 1 | 0 | OK | Personal data is protected under data protection law (GDPR) regardless of the classification label, and carries the Personal data marker. The label does not decide whether processing is lawful. | ||
| RS-08 | Keep the retention schedule | CL-11 | C | C | C | A | 1 | 0 | OK | Dispose of information and media using the level's disposal rule and the method for the media type. Keep a certificate for every Confidential item a provider sanitises or destroys, due within [[10]] working days of collection, and a disposal record for every item destroyed in house. | ||
| RS-09 | Apply and release a legal hold | CL-15 | I | R | C | A | 1 | 1 | OK | Information under a legal hold is not changed, deleted or disposed of, whatever its retention period, until Legal releases the hold in writing. Disposal checks for a hold first. | ||
| RS-10 | Sanitise or destroy media, and reconcile the certificate | CL-11 | I | A | C | R | 1 | 1 | OK | Dispose of information and media using the level's disposal rule and the method for the media type. Keep a certificate for every Confidential item a provider sanitises or destroys, due within [[10]] working days of collection, and a disposal record for every item destroyed in house. | ||
| RS-11 | Report suspected mishandling | CL-18 | I | R | R | A | 1 | 2 | OK | Suspected mishandling, loss, or Confidential information found unlabelled or in the wrong place is reported at once through the incident reporting route (P09 IM-01). A suspected personal data breach follows the incident pack's GDPR reporting duties (RD-06 to RD-09). | ||
| RS-12 | Review the register | CL-12 | R | R | A | C | C | 1 | 2 | OK | Information owners and custodians review the register at least every [[12]] months and after a material change. | |
| RS-13 | Brief staff on the levels and the handling rules | CL-06 | C | I | A | C | 1 | 0 | OK | Apply the handling rule for the level to every action: storing, accessing, sharing inside and outside the organisation, transferring, printing, remote and mobile working, AI tools, retaining and disposing. | ||
| RS-14 | Report the headline measures | CL-20 | I | C | A | C | 1 | 0 | OK | Any departure from these rules is a P02 exception, scored and approved by the approver its band sets (EX-05); a Critical exception is approved by the board or its equivalent. The headline measures go monthly to the security and IT leadership team. |
Role holders
Each role in the matrix, what it does, who holds it and who deputises. The counts are the matrix's letters for the role. A deputy is bound by the same rules.
| Role, as the matrix names it | Core role | What the role does | Held by | Deputy | R (calc) | A (calc) | C (calc) | I (calc) | Check (calc) |
|---|---|---|---|---|---|---|---|---|---|
| Information owner | Yes | Approves the level, the purpose, who may access it, the retention period and any release; reviews the classification; approves non-standard access to it (P13 JML-04). | Each asset's owner, named on the Asset owners sheet (10 managers) | [[Deputy]] | 1 | 5 | 4 | 4 | OK |
| Custodian | Yes | Applies the technical handling the level requires: access, encryption, backup, logging, labelling in the system, and disposal. | Head of IT, IT Operations Manager, Transport office administrator, by asset (Asset owners sheet); suppliers that host a system under contract | [[Deputy]] | 4 | 2 | 3 | 1 | OK |
| User | Yes | Follows the label and the handling rule, checks recipients before sending, and reports suspected mishandling at once. | All staff, contractors and supplier staff | [[Deputy]] | 3 | 0 | 0 | 2 | OK |
| Head of Information Security | Yes | Owns this policy and the handling matrix, advises on impact, runs the handling checks and reports the measures. | Head of Information Security | [[Deputy]] | 1 | 4 | 8 | 0 | OK |
| Data Protection Officer | No | Advises on personal and special category data, retention of personal data and any personal data breach. | Data Protection Officer | [[Deputy]] | 0 | 1 | 8 | 0 | OK |
| Records manager | No | Keeps the retention schedule and the disposal records, and applies and releases legal holds on Legal's instruction. | [[e.g. Company Secretary or Head of Legal]] | [[Deputy]] | 1 | 2 | 3 | 2 | OK |
The example holder each role suggests: Information owner, e.g. system owner or the head of the function the information serves; Custodian, e.g. Head of IT, system administrator or the supplier that hosts it; User, everyone: staff, contractors and supplier staff; Head of Information Security, e.g. Head of Information Security; Data Protection Officer, or the privacy lead where no DPO is appointed; Records manager, e.g. Company Secretary or Head of Legal.
Asset owners
The owner and custodian of every asset in the Information Asset Register. The owner answers for the asset's level, access, retention and release (CL-03); the custodian applies the handling the level requires.
| Example | Asset ID | Information asset | Level | Owner | Custodian | Owner's assets (calc) | Check (calc) |
|---|---|---|---|---|---|---|---|
| EXAMPLE | IA-01 | Customer accounts and order history | Confidential | Chief Operating Officer | Head of IT | 3 | OK |
| EXAMPLE | IA-02 | Customer price lists and discount terms | Confidential | Sales Director | Head of IT | 2 | OK |
| EXAMPLE | IA-03 | Online orders and customer sign-in accounts | Confidential | Chief Operating Officer | Head of IT | 3 | OK |
| EXAMPLE | IA-04 | Payroll and staff bank details | Confidential | Chief Financial Officer | Head of IT | 2 | OK |
| EXAMPLE | IA-05 | Staff HR records, including sickness absence | Confidential | HR Director | Head of IT | 1 | OK |
| EXAMPLE | IA-06 | Supplier master data and bank details | Confidential | Chief Financial Officer | Head of IT | 2 | OK |
| EXAMPLE | IA-07 | Board and executive committee papers | Confidential | Chief Executive | Head of IT | 1 | OK |
| EXAMPLE | IA-08 | Warehouse stock levels and dispatch plans | Internal | Head of Logistics | IT Operations Manager | 3 | OK |
| EXAMPLE | IA-09 | Warehouse shift rotas | Internal | Head of Logistics | IT Operations Manager | 3 | OK |
| EXAMPLE | IA-10 | Policies, standards and procedures | Internal | Head of Information Security | IT Operations Manager | 1 | OK |
| EXAMPLE | IA-11 | Sales forecasts and marketing plans | Internal | Sales Director | IT Operations Manager | 2 | OK |
| EXAMPLE | IA-12 | IT network diagrams and system documentation | Internal | Head of IT | IT Operations Manager | 1 | OK |
| EXAMPLE | IA-13 | Supplier product data: specifications, barcodes and pack sizes | Internal | Procurement Manager | Head of IT | 1 | OK |
| EXAMPLE | IA-14 | Customer service scripts and answers to common questions | Internal | Chief Operating Officer | IT Operations Manager | 3 | OK |
| EXAMPLE | IA-15 | Published product catalogue and website pages | Public | Head of Marketing and Communications | Head of IT | 2 | OK |
| EXAMPLE | IA-16 | Press releases and the published annual report | Public | Head of Marketing and Communications | Head of IT | 2 | OK |
| EXAMPLE | IA-17 | Freight rates and quotes on the rate comparison site | Internal | Head of Logistics | Transport office administrator | 3 | OK |
Ownership check
Ownership check
The matrix, the role holders and the asset owners against the rules. Every line should say 'Meets the check' before the matrix is approved.
Checks
| Check | Result | Status | What it means |
|---|---|---|---|
| Activities in the matrix | 14 | Meets the check | The 14 activities of the pack, and any you add. |
| Activities with exactly one accountable role | 14 | Meets the check | One A per row; an activity with two owners has none. |
| Core roles with a named holder | 4 | Meets the check | The 4 core roles every asset needs: information owner, custodian, user, head of information security. |
| Roles with a check to resolve | 0 | Meets the check | Every role named, in the matrix, and a core role doing or answering for something. |
| Assets with a named owner and custodian | 17 | Meets the check | Information owners approve the level and review it when the purpose, users, law, a supplier or the risk changes, within [[15]] working days of the change. |
| Overall | 0 | Every activity and asset has an owner | The number of checks above that do not yet say 'Meets the check'. |
Assets by owner
| Owner | Assets | Confidential | What they answer for |
|---|---|---|---|
| Chief Operating Officer | 3 | 2 | Approves the level, the purpose, who may access it, the retention period and any release; reviews the classification; approves non-standard access to it (P13 JML-04). |
| Sales Director | 2 | 1 | Approves the level, the purpose, who may access it, the retention period and any release; reviews the classification; approves non-standard access to it (P13 JML-04). |
| Chief Financial Officer | 2 | 2 | Approves the level, the purpose, who may access it, the retention period and any release; reviews the classification; approves non-standard access to it (P13 JML-04). |
| HR Director | 1 | 1 | Approves the level, the purpose, who may access it, the retention period and any release; reviews the classification; approves non-standard access to it (P13 JML-04). |
| Chief Executive | 1 | 1 | Approves the level, the purpose, who may access it, the retention period and any release; reviews the classification; approves non-standard access to it (P13 JML-04). |
| Head of Logistics | 3 | 0 | Approves the level, the purpose, who may access it, the retention period and any release; reviews the classification; approves non-standard access to it (P13 JML-04). |
| Head of Information Security | 1 | 0 | Approves the level, the purpose, who may access it, the retention period and any release; reviews the classification; approves non-standard access to it (P13 JML-04). |
| Head of IT | 1 | 0 | Approves the level, the purpose, who may access it, the retention period and any release; reviews the classification; approves non-standard access to it (P13 JML-04). |
| Procurement Manager | 1 | 0 | Approves the level, the purpose, who may access it, the retention period and any release; reviews the classification; approves non-standard access to it (P13 JML-04). |
| Head of Marketing and Communications | 2 | 0 | Approves the level, the purpose, who may access it, the retention period and any release; reviews the classification; approves non-standard access to it (P13 JML-04). |
EXAMPLE owners, from the register. Replace them with your own; the counts follow the Asset owners sheet.
Lists
| RACI | Level |
|---|---|
| R | Public |
| A | Internal |
| C | Confidential |
I
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| R: responsible | Does the work. Several roles may share it. |
| A: accountable | Answers for the outcome and signs it off. Exactly one per activity; the A may also do the work. |
| C: consulted | Asked for advice before the activity is done or decided. |
| I: informed | Told after the activity is done or decided. |
| Information owner | Approves the level, the purpose, who may access it, the retention period and any release; reviews the classification; approves non-standard access to it (P13 JML-04). |
| Custodian | Applies the technical handling the level requires: access, encryption, backup, logging, labelling in the system, and disposal. |
| User | Follows the label and the handling rule, checks recipients before sending, and reports suspected mishandling at once. |
| Head of Information Security | Owns this policy and the handling matrix, advises on impact, runs the handling checks and reports the measures. |
| Data Protection Officer | Advises on personal and special category data, retention of personal data and any personal data breach. |
| Records manager | Keeps the retention schedule and the disposal records, and applies and releases legal holds on Legal's instruction. |
| Information owner | The manager accountable for an information asset: decides its level, who may access it, how long it is kept and when it is released or destroyed. |
| Custodian | The person or team that holds and runs the information for the owner, usually IT or a supplier: applies the access, storage, backup and disposal controls the level requires. |
| User | Anyone who reads, creates or handles the information, staff or supplier: follows the label and the handling rule, and reports mistakes. |
| Core role | One of the 4 roles every asset needs: information owner, custodian, user, head of information security. |
| Deputy | The person who acts for a role holder while they are away, bound by the same rules. A deputy may do the R work, never hold the A in their own name. |
| RS-nn, CL-nn | The activities of this matrix, and the rules of the Information Classification & Handling Policy they serve. |
| (calc) | A cell or column the workbook calculates. Do not type or paste over it. |
| EXAMPLE | A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 2026-09-30. Replace the holders and delete the EXAMPLE rows before approval. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Annex A 5.9 — Inventory of information and other associated assets | Asset owners: an owner for every information asset in the inventory |
| NIST CSF 2.0 | GV.RR-02 — “Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced” | Responsibilities and Role holders: roles, responsibilities and authorities for information established, communicated and checked |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2)(i) — “human resources security, access control policies and asset management” | The whole matrix: who manages information assets and their handling |
| DORA — Regulation (EU) 2022/2554 | Article 8(1) — identify, classify and document ICT-supported business functions, information assets and ICT assets, reviewed at least yearly | Responsibilities and Asset owners: roles and responsibilities for information assets identified and documented |
| GDPR — Regulation (EU) 2016/679 | Article 32(4) — “The controller and processor shall take steps to ensure that any natural person acting under the authority of the controller or the processor who has access to personal data does not process them except on instructions from the controller, unless he or she is required to do so by Union or Member State law.” | Responsibilities, RS-05, RS-07 and RS-13: people with access to personal data act on instructions and are briefed |
| ISO/IEC 27001:2022 | Annex A 5.2 — Information security roles and responsibilities | Responsibilities and Role holders: information security roles and responsibilities defined and allocated |
Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2016/679 (GDPR); Regulation (EU) 2022/2554 (DORA) and Delegated Regulation (EU) 2024/1774
ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any other framework's requirement.