Roles & Responsibilities Policy (Security RACI)
Document control
| Field | Value |
|---|---|
| Owner | Ron Benisty — CTO & CSO (ron.b@iontwrks.com) |
| Status | Approved |
| Version | 1.0 |
| Classification | Confidential |
| Approved by | Ron Benisty — CTO & CSO |
| Approval date | 2026-05-26 (Tuesday) |
| Last reviewed | 2026-05-26 |
| Review cycle | Annual — next review due May 2027 |
| Parent policy | Secure SDLC (SSDLC) |
Satisfies ISO/IEC 27001:2022 A.5.2 (information-security roles & responsibilities), supports SOC 2 CC1.1–CC1.5 (control environment) and NIST SSDF PO.2 (organizational roles). Closes Gap 13 of the SSDLC gap analysis.
1. Purpose
State unambiguously who is accountable, responsible, consulted, and informed for each SSDLC activity. Resolves the "everyone or no-one" ambiguity that Type II testing flags when control ownership is unclear.
2. Parties
| Party | Description |
|---|---|
| CTO & CSO | Ron Benisty (ron.b@iontwrks.com). Single accountable owner for the SSDLC, every sibling policy, and every Type II control. Final approver for changes to the SSDLC, the security toolchain, and exception requests. |
| S.E.T team | The internal team with Admin / production access. Holds branch-protection admin, AWS IAM users, WorkOS admin, Logz.io admin, Cloudflare admin. Operates the platform and approves contractor PRs. |
| Third-party dev firm | The contracted development firm. Write-only GitHub collaborators (no AWS access). Subject to all controls in Supply Chain & CI/CD Security. |
| Contractor developers | Named individuals within the dev firm. Bound by NDA, DPA, MFA, and the dev firm's contractual security clauses. |
| MSSP customers | The MSSPs who purchase S.E.T (Admin portal users). Manage their own client/vendor data within their tenant; subject to S.E.T's customer DPA. |
| MSSP's clients | End-customers of the MSSPs (Customer portal users). Indirect parties; their primary relationship is with the MSSP, not S.E.T. |
| Sub-processors | WorkOS, Logz.io, AWS, Cloudflare, GitHub, and any tool added later. Listed in the customer DPA. |
3. RACI — SSDLC activities
R = Responsible (does the work) · A = Accountable (one party, owns the outcome) · C = Consulted (input before the decision) · I = Informed (after the decision)
| Activity | CTO & CSO | S.E.T team | Dev firm | Sub-processors |
|---|---|---|---|---|
| Maintain SSDLC + sibling policies | A | R | I | — |
| Write application code | C | R | R | — |
| Submit pull request | I | R | R | — |
| CODEOWNER review / approve PR | A | R | — | — |
Merge to develop (nonprod) | A | R | I | — |
Promote to main (production) | A | R | — | — |
| Manage GitHub org & access | A | R | — | — |
| Manage AWS IAM & cloud access | A | R | — | — |
| Operate the security toolchain (scanners, Harden-Runner, etc.) | A | R | I | — |
| Triage CI security findings | A | R | C | — |
| Threat modeling (per feature / epic) | A | R | C | — |
| Run pen-tests / DAST | A | R | I | C (external vendor) |
| Vulnerability remediation (SLA-tracked) | A | R | R | — |
| Incident response | A | R | I | I |
| Root-cause analysis | A | R | C | — |
| Backup verification & DR drills | A | R | — | I |
| Access reviews (monthly + quarterly + annual) | A | R | — | — |
| Evidence collection & retention | A | R | I | — |
| Developer security training — S.E.T team | A | R | — | — |
| Developer security training — dev firm | C | I | A · R | — |
| Risk assessment | A | R | C | — |
| Customer breach notification (Amendment 13 + DPA) | A | R | — | I |
| Sub-processor onboarding / DPA | A | R | I | I |
| Tenant decommissioning | A | R | — | I |
| Cryptography standard upkeep | A | R | C | — |
| Audit response (SOC 2, ISO 27001, customer right-to-audit) | A | R | I | I |
4. Small-team note
S.E.T's internal team is small (see Separation of Duties §4). Where Accountable and Responsible collapse onto the same person, the compensating controls in that policy apply: branch-protection cannot be bypassed, deployments are automated via OIDC, audit logs are immutable, and four-eyes promote on production where staffing allows.
5. Right-sized expectations
This RACI reflects S.E.T at MVP scale (one CTO & CSO, a small S.E.T team, one third-party dev firm). It will be re-issued — not just re-reviewed — when:
- The team grows (a dedicated Security Engineer, an SRE function, an in-house IR rota).
- Phase 2 brings Nimbus customers into AWS Tel Aviv (Environments) — additional cloud-residency duties appear.
- A new sub-processor is introduced.
6. Document change history
| Version | Date | Author | Description of change | Approved by |
|---|---|---|---|---|
| 1.0 | 2026-05-26 | Ron Benisty (CTO & CSO) | Initial version — establishes the SSDLC RACI. | Ron Benisty (CTO & CSO) |