Who manages it definition
Who manages it means the organization can define this at a low enough level of detail to be able to effectively assign responsibility and measure performance to obtain adequate security. This clearly does not require knowing the individual who is responsible. In fact, this would be bad practice, because an individual cannot provide 24 x 7coverage. Likewise, it should not correspond to an organization so large (e.g., the Department of Sate) that the work is essentially unassigned. Rather, the granularity needed is closer to that of an “organizational unit” on a windows network which is used to define who has administrative rights to a manageable collection of assets and user accounts. Organizations have considerable flexibility in defining a standard for what constitutes adequately