Defining Cybersecurity Roles and Responsibilities Across Organizational Size and Criticality: A Governance-Oriented Framework for Public and Private Sectors

This preprint proposes a governance-oriented framework for defining cybersecurity roles and responsibilities across organizational size, sector (public versus private), and operational criticality. It distinguishes cybersecurity governance functions (e.g., executive accountability, policy direction, and risk ownership) from cybersecurity operational functions (e.g., SOC operations, IAM, vulnerability management, DevSecOps, and incident response). Drawing on cybersecurity governance measurement models, maturity frameworks, and sector-specific governance studies, the paper provides a practical role-structuring approach to improve cyber resilience, regulatory alignment, and accountability. The framework is intended to support executives, policymakers, regulators, and security leaders in designing fit-for-purpose cybersecurity operating models that scale with organizational context.