# Information Security Roles and Responsibilities

Last updated: October 22, 2026

Every security responsibility at Summerbase ApS has a named owner; in a team of 1–10, one person may hold several roles.

## Purpose

To assign accountability for the security program and make sure duties are clear, documented and reviewed.

## Roles

| Role | Responsibilities |
| --- | --- |
| CEO (Direktør) | Approves policies, accepts residual risk, sets budget, oversees the program as the governing body's representative, signs off on the annual risk assessment |
| Security Officer | Runs the security program, maintains policies, runs access reviews, risk assessment, vendor reviews and training, leads incident response. Often held by the CTO in a small team |
| CTO / Engineering lead | Owns production infrastructure on GCP, secure development, change management, backups, monitoring and disaster recovery |
| Privacy contact | Handles GDPR requests, maintains the Record of Processing Activities and sub-processor list, notifies Datatilsynet of breaches. A formal DPO is not required unless processing triggers GDPR Art. 37 |
| People / HR | Background checks, onboarding and offboarding checklists, policy acknowledgments, contractor agreements |
| All personnel | Follow the policies, complete training, protect credentials and devices, report suspected incidents at once |

## Policy

1. The people holding each role are recorded in an internal role register, kept by the CEO. The CEO formally appoints the Security Officer in writing. The register is reviewed yearly and updated whenever someone joins, leaves or changes role.
2. Where one person holds conflicting duties (for example, writing and approving their own production change), a compensating control is used, such as review by another person or the controls set out in the relevant policy (for code changes, the Secure Development Policy).
3. The CEO and Security Officer meet at least once a year to review security status, risks, incidents and audit progress. Minutes are kept as evidence.
4. Each role's security duties are included in its job description or contract.