Role guide
Security teams
Security carries the safeguards and the breach clock. The duties bind the organisation, but the first hours of a breach usually live entirely inside your function.
How to read this page. The obligations belong to your organisation, not to a role or a sector. Everything here is practical emphasis: which official duties this audience usually leads or feeds into, with links to the official text. Finishing one function's work never makes the company compliant by itself.
Work your function usually leads
Reasonable security safeguardsRule 6, official text →
The listed minimums read like a security control catalogue: encryption or masking, access control, logs and monitoring, backups, one year log and data retention, contract terms and organisational measures.
Breach response executionRule 7, official text →
Awareness, containment, the without delay intimations and the seventy two hour detailed Board submission are driven by security.
Work your function usually feeds into
Vendor security termsRule 6, official text →
The safeguards extend to processing done on your behalf, which makes processor contracts a security review item.
Log and data retentionRule 8, official text →
The one year retention of logs and associated data is operated jointly with engineering.