Watch this video on YouTube
Who should be responsible for implementing and maintaining security controls?