
Ti=Data security roles and their relationships</b> 

1.sec=The GA4GH expects that in many cases, one organization may behave in more than one operational stakeholder role. For example, a data controller may also be a data service provider; an infrastructure service provider might also offer application and data services hosted on the infrastructure they support. In such cases, the organization as a whole must demosntrate control effectiveness for the applicable controls. The expectation is that operational stakeholders should document the roles and responsibilities as appropriate within that community. Furthermore, such organization should assure that security-critical functions and responsibilities are delegated among multiple roles and multiple individuals to help avoid conflicts of interest, prevent inappropriate activities, provide broader coverage and reduce key person-risk. 

2.0.sec=Figure 3 below is a graphical representation of the delegation of responsibilities for implementing and operating in accordance with the GA4GH <b>Data Security Infrastructure Policy</b>. 

2.1.sec=<img height=500 width=700 src="https://github.com/ga4gh/data-security/raw/master/DSIP/Figures/Fig.3-responsibilities.png"> 

2.00.sec=<b>Figure 3. Allocation of responsibility for security protections.*</b> 

2.=[G/Z/ol-none/1]

3.sec=The functions listed in the vertical leftmost block are shared by all operational stakeholders, albeit in a different way for each actor (e.g data processors should notify if any breach occurs, but they are not responsible to act upon it) . Functions listed in the other blocks are allocated to data controllers, data processors, and GA4GH. 

4.sec=Infrastructure service providers may provide a wide range of services to data and application service providers, including computing, storage, network, and security services. Most commonly, these services will be virtualized across data centers and geographic locations. The applicability of, and responsibility for providing, each of the security functions within the “data processor” block will depend upon the specific services provided, as well as the contractual agreements established between infrastructure service providers and their customers. 

=[G/Z/ol/s4]

{'avg_line_length': 118.57894736842105, 'max_line_length': 840, 'alphanum_fraction': 0.8180204172214824, 'licenses': ['MIT'], 'repository_name': 'CommonAccord/Cmacc-Or', 'path': 'Doc/G/GA4GH/data-security/DSIP_v4.0/Sec/SecurityFoundation/Role/0.md', 'size': 2257, 'lang': 'Markdown'}