The responsibility of an organization to protect its assets, including IT infrastructure and information, falls under the broader umbrella of governance, risk management, and compliance (GRC). Governance ensures that organizational activities, like managing IT operations, are aligned with the business’s goals, risk management involves identifying, assessing, and mitigating risks, and compliance ensures that the organization adheres to laws, regulations, and policies.

References = While I can’t provide direct references from the Cybersecurity Audit Manual, the concept of GRC is widely recognized in cybersecurity frameworks and best practices, such as those outlined by ISACA and other industry standards.