In addition to the security program management responsibilities, many other responsibilities throughout the organization should also be discussed in the policy, including the role of line managers, applications owners, data users, and the computer systems security group.