Responsibility - Revision history

Tom: /* Moral versus Legal Responsibility */

2026-01-21T22:19:51Z

‎Moral versus Legal Responsibility

Tom: /* References */

2026-01-21T22:19:25Z

‎References

Tom: /* Context */

2023-10-31T00:29:03Z

‎Context

Tom: /* Source */

2023-06-29T01:25:21Z

‎Source

Tom: /* Inspector General */

2023-06-29T01:23:05Z

‎Inspector General

Tom: /* Inspector General */

2023-06-29T01:22:25Z

‎Inspector General

Tom: /* Chief Information Security Officer */

2023-06-29T00:53:21Z

‎Chief Information Security Officer

Tom: /* Chief Information Security Officer */

2023-06-28T20:25:49Z

‎Chief Information Security Officer

Tom: /* Chief Information Security Officer */

2023-06-28T20:24:12Z

‎Chief Information Security Officer

Tom: /* References */

2023-06-28T20:07:29Z

‎References

@@ Line 39: / Line 39: @@
 ## Flexibility: Varies significantly between individuals and cultures.
 # Legal Responsibility
-Source: External authorities (government, legislature) via constitutions, statutes, regulations.
+## Source: External authorities (government, legislature) via constitutions, statutes, regulations.
 ## Scope: Universal within a jurisdiction; defines minimum acceptable behavior (e.g., paying taxes, not stealing).
 ## Enforcement: Formal state mechanisms (police, courts, fines, jail).
@@ Line 46: / Line 46: @@
 ## Overlap: Many laws are based on shared moral values (e.g., laws against murder), creating scenarios where legal and moral duties align.
 ## Conflict: An action can be legal but immoral (e.g., exploiting a loophole) or illegal but moral (e.g., civil disobedience against unjust laws).
 ## Example: A person might feel a moral duty to help a struggling friend (moral) but not be legally required to (legal), unless a contract or specific statute exists.
 ==References==
 [[Category: Glossary]]
 [[Category: Trust]]

@@ Line 31: / Line 31: @@
 A debate has been raging (in 2023) about whether the owner should be responsible for updates. An argument has been made the the manufacturer should bear full responsibility for failures and would then be incentivized to make the software better. For an extreme example see [[Code of Hammurabi]]. But "if there were unlimited liability by the manufacture there would very few of them in business. ... For a selling party to assume liability for a defect found in a product, in the U.S. Uniform Commercial Code the product has to be considered "tangible"—and the UCC says software is still considered to be "a general intangible."<ref>Drug and Device Law. New Decision Directly Addresses the "Is Software a Product" Question. (May 2, 2022); https://bit.ly/3JrKZnE</ref> In an odd way, this actually makes sense. Engineering disciplines only exist in tangible areas, such as civil, chemical, mechanical, and electrical engineering where tables of materials strengths and properties can be created and regulations can be created around acceptable safety margins based on intended use. No such tables exist for software, and none have shown a sign of emerging over the past 20 years."<ref>Steve Lipner +1, ''Updates, Threats, and Risk Management'' (2023-05) '''CACM 66''' No. 5 p. 21-23</ref>
 ==References==
 [[Category: Glossary]]
 [[Category: Trust]]

@@ Line 6: / Line 6: @@
 ==Context==
-In [[Identity and Access Management]] [[Responsibility]] is a topic of major concern. Who, exactly, should be responsible for acts taken to identify the person who has [[Authorization]] to act?
+In [[Identity and Access Management]] [[Responsibility]] is a topic of major concern. Who, exactly, should be responsible for acts taken to identify the person who acquires [[Authorization]] to act?
 # Issuer of an Identity Credential
 # Holder of an Identity Credential

@@ Line 17: / Line 17: @@
 ==Source==
-The root of all enterprise responsibility comes from the committee given that responsibility by law, typically it will be a board of directors or similar group charged with that function. One critical function for that board or committee is to approve a risk assessment and assign one or two individuals to report to the board on the results of that assessment on a regular basis. While that responsibility was often give the the CEO, recent practice to to assign a specific other individual to give an independent report to the board. We consider two such individuals in the page.
+The root of all enterprise responsibility comes from the committee given that responsibility by law, typically it will be a board of directors or similar group charged with that function. One critical function for that board or committee is to approve a risk assessment and assign one or two individuals to report to the board on the results of that assessment on a regular basis. While that responsibility was often give the the CEO, recent practice to to assign a specific other individual to give an independent report to the board. We consider two such individuals in the page. It is, of course. likely that other titles have been created in other organizations. The important thing is for that individual to be able to report up to the board.
 ===Chief Information Security Officer===

@@ Line 25: / Line 25: @@
 ===Inspector General===
-In the United States, other than in the military departments, the first Office of Inspector General was established by act of Congress in 1976[1] under the Department of Health and Human Services to eliminate waste, fraud, and abuse in Medicare, Medicaid, and more than 100 other departmental programs<ref>HHS ''About the Office of Inspector General'', https://oig.hhs.gov/about-oig/</ref>
+In the United States, other than in the military departments, the first Office of Inspector General was established by act of Congress in 1976 in the Department of Health and Human Services to eliminate waste, fraud, and abuse in Medicare, Medicaid, and more than 100 other departmental programs<ref>HHS ''About the Office of Inspector General'', https://oig.hhs.gov/about-oig/</ref>
 ==Authorization==

← Older revision		Revision as of 01:22, 29 June 2023
Line 25:		Line 25:

	===Inspector General===		===Inspector General===
		+	In the United States, other than in the military departments, the first Office of Inspector General was established by act of Congress in 1976[1] under the Department of Health and Human Services to eliminate waste, fraud, and abuse in Medicare, Medicaid, and more than 100 other departmental programs<ref>HHS ''About the Office of Inspector General'', https://oig.hhs.gov/about-oig/</ref>

	==Authorization==		==Authorization==

@@ Line 22: / Line 22: @@
 ===Chief Information Security Officer===
-SolarWinds in November 2022 disclosed it had received a Wells Notice in connection with the cyberattack. The investigation related to potential violations of securities laws related to cybersecurity disclosures and public statements. The Securities and Exchange Commission in June 2023 notified the chief financial officer and CISO of SolarWinds about potential enforcement actions related to the 2020 cyberattack against the company’s Orion software platform, the company disclosed in a [https://d18rn0p25nwr6d.cloudfront.net/CIK-0001739942/02aed9ff-6065-4158-8efd-6b5e31f7eb89.pdf regulatory filing with the agency]. Potential SEC measures against the executives include barring them from engaging in the same actions in the future, imposing civil penalties or barring them from serving as officers or directors of public companies, according to the filing.<ref> David Jones, '
+SolarWinds in November 2022 disclosed it had received a Wells Notice in connection with the cyberattack. The investigation related to potential violations of securities laws related to cybersecurity disclosures and public statements. The Securities and Exchange Commission in June 2023 notified the chief financial officer and CISO of SolarWinds about potential enforcement actions related to the 2020 cyberattack against the company’s Orion software platform, the company disclosed in a [https://d18rn0p25nwr6d.cloudfront.net/CIK-0001739942/02aed9ff-6065-4158-8efd-6b5e31f7eb89.pdf regulatory filing with the agency]. Potential SEC measures against the executives include barring them from engaging in the same actions in the future, imposing civil penalties or barring them from serving as officers or directors of public companies, according to the filing.<ref> David Jones, ''SEC notifies SolarWinds CISO and CFO of possible action in cyber investigation'' (2023-06-26) Cybersecurity https://www.cybersecuritydive.com/news/sec-solarwinds-ciso-cfo-orion/653864/</ref>
 ===Inspector General===

← Older revision		Revision as of 20:07, 28 June 2023
Line 35:		Line 35:

	[[Category: Glossary]]		[[Category: Glossary]]
		+	[[Category: Trust]]