# Exercise: Decision Rights Mapping

Organizations can use the following exercise to map security decision types to appropriate roles:

- Identify key security decision categories (e.g., policy exceptions, new technology approval)
- Document which roles are Responsible, Accountable, Consulted, and Informed for each decision type
- Define approval thresholds and escalation triggers based on risk impact
- Review the resulting matrix for gaps and conflicts
- Validate the matrix with key stakeholders before implementation

This exercise helps organizations identify and address decision authority gaps and conflicts before they cause operational problems or governance failures.

***

(c)[Kayne McGladrey](https://kaynemcgladrey.com/) - [Get the full book "Cyber Risk is a Myth"](https://www.routledge.com/Cyber-Risk-is-a-Myth-A-Business-Approach-to-Integrated-Risk-Management/McGladrey/p/book/9781041249054)