Assign responsibility for the security management function to an individual with the oversight responsibility and authority over the security management structure. The individual should have the expertise and independence to enforce security policies.