Who Owns It
The document sits between IT, HR and legal, which means it belongs to nobody and is updated by whoever was last annoyed.
Policy ownership and review
Never enforced
As written
This policy is owned by the IT department and will be reviewed annually.
What happens
The stated review has not happened for several years. The document is dated and the date is older than most of the staff.
Changes are made reactively, by whoever is dealing with an incident, and are not reviewed by anybody else.
Nobody can say who would approve a change today.
Ask who owns the acceptable use policy and the answer is usually a department. Ask who would approve a change this week and the answer is usually silence.
The practical point in “Who Owns It” is that a written rule becomes credible only through a consistent operating process. For teams exploring chronemics definition, how teams evaluate chronemics definition can add time and project context, provided collection is proportionate, access is limited and every significant inference receives human review.
Why it is nobody's
IT understands the systems and does not own the employment relationship. A clause it writes may be technically sound and unenforceable as a term of employment.
For a separate benchmark relevant to “Who Owns It”, consult the IBM insider-threat overview. Use it to test purpose, notice, permissions, retention and response procedures against the proposed operating model rather than treating a generic checklist as proof that the rule works.
HR owns the relationship and does not know what the systems do. A clause it writes may be fair and describe capabilities that do not exist.
Legal advises and does not operate anything.
Each assumes one of the others is maintaining it, and the document ages.
What unowned looks like
A date several years old.
Clauses referring to systems the organisation no longer uses, and none referring to systems it adopted since.
Reactive additions after incidents, each written by whoever handled that incident, in their own register, never reconciled with the rest.
And no record of what changed when, which matters if somebody is disciplined under a version they may not have received.
The arrangement that works
One named owner, and the role is small.
They hold the document, approve changes, run the annual audit, and brief managers. A few hours a quarter once it is in order.
They do not need to be a lawyer or a technologist. They need the authority to say no to an addition and the standing to ask whether a clause has ever been enforced.
The approval route
Changes agreed between the owner, somebody from the systems side and somebody from the employment side.
Three people, not a committee. The purpose is to catch the two failure modes: a technically impossible requirement, and an employment term nobody can apply.
Versioning, which sounds bureaucratic
A version number, a date, and a one-line note of what changed.
If somebody is disciplined under a clause, the question of which version they acknowledged is a real one, and an organisation that cannot answer it has a weaker position than the conduct warrants.
The first task for a new owner
Find out when it was last changed and why.
In most organisations the answer is an incident three years ago, and the change was a paragraph added in haste that nobody has read since.
What the owner actually does
Holds the document, approves changes, runs the annual audit, briefs managers. A few hours a quarter once it is in order, and it does not require a lawyer or a technologist.
Versioning, which matters once
If somebody is disciplined under a clause, which version did they acknowledge? An organisation that has overwritten the document repeatedly is arguing about something it cannot evidence.
Three people, not a committee
The owner, somebody from systems, somebody from employment. The purpose is to catch the two failure modes: a technically impossible requirement, and an employment term nobody can apply.
The role is small
A few hours a quarter once the document is in order. What it needs is authority to refuse an addition and standing to ask whether a clause has ever been applied.