{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/information-security-coordinator","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/information-security-coordinator/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/information-security-coordinator/"},"term":{"en":"Information security coordinator","da":"Informationssikkerhedskoordinator"},"aka":{"en":["security coordinator"],"da":["sikkerhedskoordinator"]},"domain":["security"],"cluster":"compliance","layer":"governance","status":"current","summary":{"en":"The person who keeps an organisation's day-to-day security work organised, tracked and reported to management.","da":"Den person, der holder organisationens daglige sikkerhedsarbejde organiseret, fulgt op og rapporteret til ledelsen."},"body":{"formal":{"en":"A role that runs the security programme in practice - keeping policies and the risk picture up to date, following up on controls and incidents, and linking IT, suppliers and management - often as the owner of the ISMS.","da":"En rolle, der driver sikkerhedsarbejdet i praksis - holder politikker og risikobilledet opdateret, følger op på kontroller og hændelser og forbinder IT, leverandører og ledelse - ofte som ejer af ISMS'et."},"plain":{"en":"Like a wedding planner - they do not cook, play music or take photos, but they make sure everyone who does shows up on time and knows the plan.","da":"Som en bryllupsplanlægger - de laver ikke maden, spiller ikke musik og tager ikke billeder, men sørger for, at alle der gør, møder op til tiden og kender planen."},"inPractice":{"en":"Every quarter the coordinator at a Danish university college collects status from the IT department and HR, updates the risk list and brings three decisions the management team needs to make.","da":"Hvert kvartal samler koordinatoren på en dansk professionshøjskole status ind fra IT-afdelingen og HR, opdaterer risikolisten og fremlægger tre beslutninger, som ledelsen skal træffe."},"whyItMatters":{"en":"Without one person holding the threads, security tasks get dropped between departments and management loses sight of where the organisation stands.","da":"Uden én person, der holder i trådene, falder sikkerhedsopgaver mellem afdelingerne, og ledelsen mister overblikket over, hvor organisationen står."}},"deepDive":{"en":"The role has no single legal definition; it is the practical answer to ISO/IEC 27001:2022 clause 5.3, which requires top management to assign responsibility and authority for ensuring that the ISMS conforms to the standard and for reporting ISMS performance to top management. Annex A control 5.2 (information security roles and responsibilities) requires those roles to be defined and allocated, and 5.4 (management responsibilities) requires managers to make staff apply security in line with policy. In the Danish public sector, where state institutions have been required to work according to ISO 27001 since 2016, \"informationssikkerhedskoordinator\" is a common title for the person who operates the ISMS on behalf of the management, often reporting to a security committee or the director.\n\nThe recurring deliverables map closely to the standard. The coordinator maintains the policy set and the documented information required by 7.5, runs the risk assessment cycle (6.1.2) and keeps the risk treatment plan and Statement of Applicability current (6.1.3), tracks the information security objectives and their measurement (6.2 and 9.1), organises internal audits (9.2) without auditing their own work, and prepares management review (9.3). The inputs to management review in 9.3.2 give a ready-made agenda: status of previous actions, changes in internal and external issues and in interested parties' needs, trends in nonconformities, monitoring results, audit results and objectives, feedback from interested parties, results of risk assessment and status of the treatment plan, and opportunities for improvement.\n\nThe role coordinates rather than executes. Technical controls are operated by IT operations or suppliers, HR owns screening and onboarding and offboarding (Annex A 6.1-6.5), and procurement owns contract terms (5.19-5.22). The coordinator's leverage comes from mandate and reporting lines, not from administrative privileges; segregation of duties (Annex A 5.3) argues against the coordinator also being the sole system administrator who approves their own changes. In incidents, the coordinator typically acts as incident manager or liaison, assembling facts for NIS2 Art. 23 notifications or GDPR Art. 33 notifications while technical responders contain the event.\n\nThe role is easily confused with neighbours. A CISO is an executive owning security strategy and budget; in smaller organisations one person may hold both titles, but the coordinator role alone rarely carries decision authority over budget or risk acceptance, which remains with risk owners and management, and under NIS2 Art. 20 accountability stays with the management body. A data protection officer under GDPR Arts. 37-39 must be independent, may not receive instructions on the performance of DPO tasks and must avoid conflicts of interest, so combining DPO and security coordinator roles needs careful assessment. A compliance and risk coordinator focuses on mapping requirements and evidence; the information security coordinator runs the whole programme day to day.","da":"Rollen har ingen samlet juridisk definition; den er det praktiske svar på ISO/IEC 27001:2022 punkt 5.3, som kræver, at den øverste ledelse tildeler ansvar og beføjelser til at sikre, at ISMS'et lever op til standarden, og til at rapportere om ISMS'ets præstation til den øverste ledelse. Annex A-kontrol 5.2 (roller og ansvar for informationssikkerhed) kræver, at rollerne defineres og fordeles, og 5.4 (ledelsens ansvar) kræver, at ledere får medarbejderne til at efterleve sikkerheden i overensstemmelse med politikken. I den offentlige sektor, hvor statslige institutioner har skullet arbejde efter ISO 27001 siden 2016, er \"informationssikkerhedskoordinator\" en udbredt titel for den person, der driver ISMS'et på ledelsens vegne og ofte refererer til et sikkerhedsudvalg eller direktionen.\n\nDe tilbagevendende leverancer passer tæt til standarden. Koordinatoren vedligeholder politiksættet og den dokumenterede information efter 7.5, driver risikovurderingscyklussen (6.1.2) og holder risikohåndteringsplanen og Statement of Applicability opdateret (6.1.3), følger informationssikkerhedsmålene og målingen af dem (6.2 og 9.1), tilrettelægger interne audits (9.2) uden at auditere sit eget arbejde og forbereder ledelsens gennemgang (9.3). Input til ledelsens gennemgang i 9.3.2 giver en færdig dagsorden: status på tidligere handlinger, ændringer i interne og eksterne forhold og i interessenters behov, udviklingen i afvigelser, overvågningsresultater, auditresultater og målopfyldelse, feedback fra interessenter, resultater af risikovurderingen og status på håndteringsplanen samt forbedringsmuligheder.\n\nRollen koordinerer frem for at udføre. Tekniske kontroller drives af IT-driften eller leverandører, HR ejer screening samt on- og offboarding (Annex A 6.1-6.5), og indkøb ejer kontraktvilkårene (5.19-5.22). Koordinatorens gennemslagskraft kommer fra mandat og referencelinjer, ikke fra administratorrettigheder; funktionsadskillelse (Annex A 5.3) taler imod, at koordinatoren også er den eneste systemadministrator, der godkender sine egne ændringer. Ved hændelser fungerer koordinatoren typisk som incident manager eller bindeled, der samler fakta til indberetninger efter NIS2 art. 23 eller anmeldelser efter GDPR art. 33, mens de tekniske folk inddæmmer hændelsen.\n\nRollen forveksles let med naboroller. En CISO er en leder med ansvar for sikkerhedsstrategi og budget; i mindre organisationer kan én person have begge titler, men koordinatorrollen alene har sjældent beslutningskompetence over budget eller risikoaccept, som ligger hos risikoejerne og ledelsen, og efter NIS2 art. 20 forbliver ansvaret hos ledelsesorganet. En databeskyttelsesrådgiver efter GDPR art. 37-39 skal være uafhængig, må ikke modtage instrukser om udførelsen af sine opgaver og skal undgå interessekonflikter, så en kombination af DPO- og sikkerhedskoordinatorrollen kræver en grundig vurdering. En compliance- og risikokoordinator fokuserer på at koble krav og dokumentation; informationssikkerhedskoordinatoren driver hele programmet i hverdagen."},"edges":[{"type":"requires","to":"security/isms","confidence":"high","strength":"normal"},{"type":"kind-of","to":"security/grey-roles","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/risk-management","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/security-policy","confidence":"high","strength":"normal"}],"depth":6,"sources":[{"title":"Cyber Security Fast Track - Kursuskompendium, Kursistens udbytte","tier":"course-material"},{"title":"ISO/IEC 27001:2022 (clause 5.3 - Organizational roles, responsibilities and authorities)","tier":"standard"}],"draft":true}