The short answer
Assign a decision owner, an operator, and a reviewer for each security activity. Confirm those responsibilities against your actual provider agreements. A job title or a managed IT contract does not establish every handoff.
How to use it
- Choose one activity before assigning every security task. Account removal is a useful starting point because it crosses staff, application owners, and providers.
- Record roles rather than personal information. Ask each participant to confirm the responsibility and identify any contract or access limits.
- Specify who can authorize an exception and how the reviewer will establish that the action took effect. Review the matrix when a provider or business process changes.
A worked example
Fictional example: a small design business uses an external IT provider. Operations reports a contractor departure; the business owner approves removal; the provider disables the managed account; an application owner removes access to a separately managed design portal. The reviewer checks both systems. The unresolved question is who owns the portal when that application owner is away.
Your worksheet
Use roles and high-level descriptions only. Do not enter passwords, personal information, confidential links, or client data. Notes stay in this open page and are lost on reload. Downloads are saved on your device.
What this does and does not establish
This worksheet records proposed responsibilities, not a contractual assignment or proof that controls work. Confirm decisions with the people and providers involved.
Sources
Worksheet design and fictional example: CyberWiz. The sources explain the underlying framework; they do not endorse this template.