In the three lines model, thesecond lineprovides oversight and monitoring of risk and compliance. CRISC states that functions such as risk management, compliance monitoring, and policy oversight belong to the second line. Monitoring IT security policy compliance fits this role because it evaluates whether operational controls align with requirements. The first line (operations) configures systems like WAFs and calculates operational KRIs. The third line (internal audit) validates whether controls are functioning independently. Thus, the responsibility most aligned with the second line is monitoring compliance.
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit