{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/compliance-and-risk-coordinator","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/compliance-and-risk-coordinator/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/compliance-and-risk-coordinator/"},"term":{"en":"Compliance and risk coordinator","da":"Compliance- og risikokoordinator"},"aka":{"en":["compliance coordinator","risk coordinator"],"da":["compliancekoordinator","risikokoordinator"]},"domain":["security"],"cluster":"compliance","layer":"governance","status":"current","summary":{"en":"A role, often a first job in the field, that tracks which rules apply, where the organisation falls short, and how its risks are handled.","da":"En rolle, ofte på begynderniveau, der følger med i, hvilke regler der gælder, hvor organisationen halter, og hvordan risici håndteres."},"body":{"formal":{"en":"A role that maps legal and standard requirements to the organisation's practice, runs gap analyses and risk assessments, keeps the evidence in order and reports progress and open risks to management.","da":"En rolle, der kobler krav fra love og standarder til organisationens praksis, gennemfører gap-analyser og risikoanalyser, holder dokumentationen i orden og rapporterer fremdrift og åbne risici til ledelsen."},"plain":{"en":"Like a bookkeeper for rules - keeping the list of what is owed, what is paid and what is overdue, so there are no surprises when the inspector comes.","da":"Som en bogholder for regler - der holder listen over, hvad der skyldes, hvad der er betalt, og hvad der er forfaldent, så der ikke kommer overraskelser, når kontrollen kommer."},"inPractice":{"en":"Two weeks before an ISO 27001 audit at a Danish energy company, the coordinator checks each requirement against the evidence folder and chases three risk owners for missing records.","da":"To uger før en ISO 27001-audit i et dansk energiselskab tjekker koordinatoren hvert krav mod mappen med dokumentation og rykker tre risikoejere for manglende materiale."},"whyItMatters":{"en":"Rules like NIS2 and GDPR expect proof, not good intentions, and this role is what turns scattered work into something the organisation can show.","da":"Regler som NIS2 og GDPR kræver bevis, ikke gode hensigter, og denne rolle er det, der gør spredt arbejde til noget, organisationen kan fremvise."}},"deepDive":{"en":"The compliance half of the role starts with a requirements register, which ISO/IEC 27001:2022 Annex A control 5.31 demands: legal, statutory, regulatory and contractual requirements relevant to information security must be identified, documented and kept up to date. For a Danish organisation this typically includes the NIS2-loven and its executive orders, GDPR and databeskyttelsesloven, sector rules such as DORA for finance, the CER-loven for designated critical entities, bookkeeping rules on retention, and security clauses in customer contracts and data processing agreements. Each requirement is decomposed and mapped to internal controls, so one control, for example quarterly access reviews, can be shown to satisfy several sources. Control 5.36 then requires regular review of compliance with the organisation's own policies and standards.\n\nThe risk half follows ISO/IEC 27001 clause 6.1.2 and ISO/IEC 27005:2022. The coordinator maintains the risk criteria, including acceptance criteria and criteria for performing assessments, that make results consistent, valid and comparable, runs assessments at planned intervals and on significant change (clause 8.2), and keeps the risk register: risk statement, owner, likelihood and consequence ratings, existing controls, treatment decision, planned actions and residual risk. The coordinator facilitates but does not own the risks; clause 6.1.3 f requires risk owners to approve the treatment plan and accept residual risk. A methodological trap worth knowing is multiplying ordinal scores on a 5x5 heat map, which produces rankings that look precise but can misorder risks; better practice anchors each scale level to concrete ranges such as downtime hours or financial loss bands.\n\nEvidence management is the operational core. Auditors and supervisory authorities test what can be shown: tickets, logs, signed approvals, training records, restore-test reports and supplier assessments. The coordinator defines for each control what evidence is expected, at what frequency and where it is stored, so that retained documented information (clause 7.5) is produced as a by-product of normal work rather than assembled before an audit. Key risk indicators, such as the share of critical vulnerabilities past deadline or the number of accounts without MFA, turn the register into something management can monitor.\n\nIn the IIA Three Lines Model the role is a second-line function: it supports and challenges operational management (first line) and is itself reviewed by internal audit or an independent review under Annex A 5.35 (third line), so it should not audit its own work. The closest ECSF profiles are the Cyber Legal, Policy and Compliance Officer and the Cybersecurity Risk Manager. Compared with the information security coordinator, which runs the entire programme, this role is narrower and more evidence- and requirement-centred; in small organisations the two are frequently held by the same person.","da":"Compliancedelen af rollen begynder med et kravregister, som ISO/IEC 27001:2022 Annex A-kontrol 5.31 kræver: lov-, myndigheds- og kontraktkrav med betydning for informationssikkerheden skal identificeres, dokumenteres og holdes ajour. For en dansk organisation omfatter det typisk NIS2-loven og dens bekendtgørelser, GDPR og databeskyttelsesloven, sektorregler som DORA for finanssektoren, CER-loven for udpegede kritiske enheder, bogføringsreglerne om opbevaring og sikkerhedsbestemmelser i kundekontrakter og databehandleraftaler. Hvert krav nedbrydes og mappes til interne kontroller, så én kontrol, fx en kvartalsvis gennemgang af adgange, kan dokumenteres at opfylde flere kilder. Kontrol 5.36 kræver derefter, at overholdelsen af organisationens egne politikker og standarder gennemgås regelmæssigt.\n\nRisikodelen følger ISO/IEC 27001 punkt 6.1.2 og ISO/IEC 27005:2022. Koordinatoren vedligeholder risikokriterierne, herunder kriterier for accept og for gennemførelse af vurderinger, der gør resultaterne konsistente, gyldige og sammenlignelige, gennemfører vurderinger med planlagte mellemrum og ved væsentlige ændringer (punkt 8.2) og fører risikoregistret: risikobeskrivelse, ejer, vurdering af sandsynlighed og konsekvens, eksisterende kontroller, håndteringsbeslutning, planlagte handlinger og restrisiko. Koordinatoren faciliterer, men ejer ikke risiciene; punkt 6.1.3 f kræver, at risikoejerne godkender håndteringsplanen og accepterer restrisikoen. En metodisk fælde er at gange ordinale scorer sammen på et 5x5-varmekort, hvilket giver rangordninger, der ser præcise ud, men kan placere risici forkert; bedre praksis knytter hvert niveau på skalaen til konkrete intervaller som timers nedetid eller tabsbeløb.\n\nStyring af dokumentation er den operative kerne. Auditorer og tilsynsmyndigheder tester det, der kan fremvises: sager, logs, underskrevne godkendelser, uddannelsesregistreringer, rapporter fra gendannelsestest og leverandørvurderinger. Koordinatoren fastlægger for hver kontrol, hvilken dokumentation der forventes, hvor ofte og hvor den gemmes, så den dokumenterede information (punkt 7.5) opstår som et biprodukt af det daglige arbejde i stedet for at blive samlet op lige før en audit. Nøglerisikoindikatorer som andelen af kritiske sårbarheder over fristen eller antallet af konti uden MFA gør registret til noget, ledelsen kan følge.\n\nI IIA's Three Lines Model er rollen en andenlinjefunktion: den støtter og udfordrer den operative ledelse (første linje) og bliver selv gennemgået af intern revision eller en uafhængig gennemgang efter Annex A 5.35 (tredje linje), så den bør ikke auditere sit eget arbejde. De nærmeste ECSF-profiler er Cyber Legal, Policy and Compliance Officer og Cybersecurity Risk Manager. Sammenlignet med informationssikkerhedskoordinatoren, der driver hele programmet, er rollen smallere og mere centreret om krav og dokumentation; i små organisationer har den samme person ofte begge roller."},"edges":[{"type":"requires","to":"security/compliance","confidence":"high","strength":"normal"},{"type":"requires","to":"security/risk-management","confidence":"high","strength":"normal"},{"type":"kind-of","to":"security/grey-roles","confidence":"high","strength":"normal"},{"type":"contrasts-with","to":"security/information-security-coordinator","why":{"en":"The compliance and risk coordinator checks against rules and risks; the security coordinator runs the whole security programme day to day.","da":"Compliance- og risikokoordinatoren tjekker mod regler og risici; sikkerhedskoordinatoren driver hele sikkerhedsarbejdet i hverdagen."},"confidence":"medium","strength":"normal"},{"type":"used-with","to":"security/gap-analysis","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/risk-assessment","confidence":"high","strength":"normal"}],"depth":5,"sources":[{"title":"Cyber Security Fast Track - Kursuskompendium, Kursistens udbytte","tier":"course-material"}],"draft":true}