Who should own Cyber Essentials controls after certification?

After Cyber Essentials certification, control ownership remains with the organisation rather than the certification body or an external IT provider. Senior management should retain overall governance, while operational responsibility is allocated to the people who can make changes, check results and escalate weaknesses in each relevant area.

The important distinction is between accountability and day-to-day responsibility. A director or other senior decision-maker is accountable for ensuring that the organisation’s security arrangements are appropriate and maintained. An IT lead, internal administrator or managed service provider may carry out the technical work, but that does not remove management’s responsibility for deciding how the controls are applied to the business.

A practical ownership model usually involves the following roles:

• Senior management: approves the organisation’s security approach, accepts or resolves material risks, provides suitable resources and ensures that security remains part of business governance.
• IT or technical lead: maintains the technical configuration, monitors control performance and records remedial actions.
• People or HR function: supports joiner, mover and leaver processes, ensures that access changes are communicated and helps maintain staff security responsibilities.
• System and application owners: understand how particular systems are used, identify business-critical data and confirm that changes will not undermine the required controls.
• Procurement or supplier management: checks that outsourced services and technology suppliers have clearly defined security obligations.
• All users: follow approved procedures, protect credentials, report suspected incidents and avoid bypassing technical safeguards.

The person assigned to a control needs enough authority to act. Naming someone who can only observe a problem, but cannot approve a change or obtain the necessary support, creates nominal ownership rather than effective ownership. Each owner should therefore have a clear remit, access to relevant information and a defined route for escalating decisions that exceed their authority.

Ownership should also follow the organisation’s actual technology boundaries. For example, an internal IT team may manage laptops and network equipment, while a cloud supplier controls part of the underlying platform. The organisation should still identify who verifies that the supplier’s arrangements meet its requirements, who reviews available security settings and who responds when a supplier changes its service. Outsourcing an activity can delegate its execution, but it does not make the associated risk disappear.

Useful ownership records normally include:

• the control or security activity covered;
• the accountable senior role;
• the operational owner and any deputy;
• the systems, users or suppliers within scope;
• the checks the owner must perform and the records they must retain;
• the action to take when a check fails; and
• the person authorised to approve exceptions or accept residual risk.

This information can be held in a responsibility matrix, security policy, asset register or control register. The format matters less than whether it is current, understood by the people named and consistent with the organisation’s actual working practices. A document that assigns responsibility to a former employee or an obsolete supplier contact is not an effective control.

Control owners should maintain evidence that supports ongoing governance. Depending on the control, this may include configuration records, update reports, access reviews, records of removed accounts, malware protection status, incident tickets, supplier reviews and management decisions. The purpose is not to create paperwork for its own sake; it is to show what was checked, when it was checked, what was found and how unresolved issues were handled.

Reviews should be triggered by meaningful business or technology changes, not only by the next certification exercise. Examples include adopting a new cloud service, opening or closing a site, changing an IT supplier, introducing a new type of device, restructuring teams, acquiring another business or experiencing a security incident. These events can alter the systems in scope and may require responsibilities, procedures and technical settings to be reassessed.

Where a weakness is identified, the owner should record its impact, the corrective action, the person responsible for completing that action and the escalation point if it cannot be completed as planned. Senior management should be involved where the issue affects important systems, creates significant exposure or requires a business decision. This prevents unresolved technical findings from becoming invisible risks.

Cyber Essentials certification is therefore best treated as part of an ongoing governance process rather than as a certificate with no further ownership requirement. Clear role boundaries, current records, evidence of checks and management oversight help ensure that the controls continue to reflect the organisation’s real systems and working practices after certification.