CC1.3 CC1
Control Environment / CC1.3
Structures, reporting lines and authority set deliberately
In plain English
Management establishes who reports to whom and who is allowed to decide what, so responsibility for security has an owner rather than being everyone's job and therefore nobody's.