Who does what — RACI matrix
R responsible for execution · A accountable for the outcome · C consulted · I informed.
| Activity | Dev | DevSecOps | PSIRT | CISO | Legal | Product | Procurement | Leadership |
|---|---|---|---|---|---|---|---|---|
| PDE qualification | C | A/R | C | I | ||||
| Criticality classification | R | A | C | I | ||||
| Choice of assessment route | C | A/R | C | I | ||||
| Contracting a notified body | C | R | I | C | A | |||
| Risk assessment | C | C | C | A/R | C | C | I | |
| SBOM generation | R | A/R | I | C | I | |||
| SBOM quality validation | R | R | A | I | ||||
| Licence policy | I | C | C | A/R | C | C | I | |
| Licence exception handling | R | C | C | A | C | |||
| Vulnerability triage | C | R | A/R | C | I | I | ||
| Producing VEX statements | R | C | A | C | C | |||
| Decision to report | R | C | A | I | I | |||
| Drafting and sending the report | A/R | C | C | I | I | |||
| Relations with authorities | C | C | A/R | I | I | |||
| Compiling the technical documentation | C | C | C | R | A | C | I | |
| Signing the EU declaration | C | R | I | A | ||||
| Affixing the CE marking | I | A/R | R | I | ||||
| Determining the support period | C | C | R | R | C | A | ||
| Publishing security advisories | C | A/R | C | C | I | |||
| Managing the CVD policy | A/R | C | C | I | I | |||
| Supplier clauses | C | A/R | C | R | I | |||
| Evidence archiving | R | C | A/R | I |
Reading the matrix
Three principles follow.
Legal approves, Cyber executes — except on triage. The technical qualification of a vulnerability belongs to the PSIRT, which is accountable for it. The decision to report belongs to Legal. The line is clean and must stay clean.
Executive management approves three things only: engaging a notified body, the support period, and signing the declaration. Those are the three decisions that commit the company financially over several years.
Nobody works alone. Every row has at least one consulted party. An activity with no cross-consultation will produce a deliverable the next stage cannot use.
The three trade-offs to settle explicitly
They do not follow from the matrix: they require a written committee decision.
1. Who decides to report within 24 hours, and who decides in their absence?
The answer must name a person, a deputy, and provide for a written delegation. A 24-hour deadline does not accommodate escalation up the hierarchy on a Sunday. See Reporting duties.
2. Who holds the right of veto over placing on the market?
If nobody can block a market launch, the technical documentation will be assembled afterwards. Recommended position: the legal department, on the basis of the checklist, with an override available only through a written decision of executive management — which then becomes an entry in the risk register.
3. Who arbitrates between fixing and documenting in a VEX?
Both are defensible; cost and risk differ. Recommended position: the PSIRT approves the VEX status, with escalation to the CISO on disagreement with the product team, and notice to Legal as soon as the vulnerability is public.
What to write down
The matrix above, completed with names — function and person, with a deputy for every critical role. A matrix in generic functions does not survive the first departure; a named matrix gets updated, which forces vacancies to be noticed.