SFS D: Roles, Responsibilities, Authorities, and Security Policy
Assess whether security duties, decision authority, policies, and operating procedures have clear owners and documented review arrangements.
Scope and boundaries
This set covers organizational accountability, policy approval, responsibilities, exception decisions, supplier oversight, workforce awareness, and escalation authority. Questions should connect each duty to an identified role and evidence that the relevant procedure has been communicated or followed. Governance defines who is responsible and authorized; technical enforcement is assessed in the relevant infrastructure or application set. Operational incident handling belongs to SFS 6, while engineering risk-treatment practices belong to SFS 8.
The sixteen questions
Each SF position is one question. Both positions run from 0 to F.
| SF | Question page | Authoring record |
|---|---|---|
| 0 | SF 0 | 00D0 |
| 1 | SF 1 | 00D1 |
| 2 | SF 2 | 00D2 |
| 3 | SF 3 | 00D3 |
| 4 | SF 4 | 00D4 |
| 5 | SF 5 | 00D5 |
| 6 | SF 6 | 00D6 |
| 7 | SF 7 | 00D7 |
| 8 | SF 8 | 00D8 |
| 9 | SF 9 | 00D9 |
| A | SF A | 00DA |
| B | SF B | 00DB |
| C | SF C | 00DC |
| D | SF D | 00DD |
| E | SF E | 00DE |
| F | SF F | 00DF |
From questions to a profile
Only reviewed, accepted 0/1 assessments can populate the sixteen-bit set profile. SF 0 is the most significant bit and SF F the least significant bit. The completed result uses four hexadecimal digits, including leading zeros. A catalog definition does not establish a completed assessment profile.
Read assessment and validation, then encoding. A set profile preserves individual answers; it is not a summed security score.