Clarifying Roles and Responsibilities: Making Outsourcing and Incident Response Accountable

In July 2024, a faulty content configuration update issued by cybersecurity software provider CrowdStrike caused widespread Windows system outages around the world. Major enterprises, including Delta Air Lines, suffered severe flight disruptions and operational paralysis. The incident brought a deeper governance issue surrounding outsourced services into sharp focus: when critical services depend heavily on external vendors, who is ultimately responsible for decisions made during an outage and for managing the aftermath?

Jo-Fan Yu, Director and CEO of the Taiwan Network Information Center (TWNIC), emphasized that accountability in digital services must be embedded both within an organization’s internal management structure and in its relationships with external service providers.

“Outsourcing is a form of professional division of labor, but it does not replace operational responsibility,” Yu said.

▲ Jo-Fan Yu, Director and CEO of the Taiwan Network Information Center (TWNIC)

Clarifying Roles and Responsibilities

The essence of “accountability” is ensuring that responsibility can be clearly assigned and effectively carried out.

Yu recommends that companies define responsibilities while services are operating normally: who determines security requirements, who approves major changes, who leads the response when an incident occurs, who handles external communications, and who follows up on corrective actions afterward.

For important external-facing channels such as official websites and corporate email, companies should establish clear roles in advance. IT personnel may be responsible for technical matters, business managers for evaluating operational impact, and senior management for deciding how resources should be allocated. A designated person should also be responsible for cross-departmental coordination.

Without such arrangements, organizations may find themselves without clear leadership during an incident, with different departments shifting responsibility to one another. Clear accountability ultimately helps strengthen consumer trust in the company.

Hosting a Domain Does Not Mean Owning It

Even when companies engage external parties to manage their domains and websites, they should retain control over registrant information and administrative privileges.

In Criminal Judgment No. 1260 of 2023 issued by the New Taipei District Court, Taiwan, the defendant had been entrusted with managing a company’s operations and two domain names. During the engagement, the defendant changed the registrant of one of the domains to a company under the defendant’s own name without authorization. After the engagement ended, the defendant also deleted content from both websites and changed certain contact information.

The court found that these actions constituted breach of trust and offenses relating to interference with computer use. The judgment also made clear that being entrusted with the management of a domain name and website does not confer ownership of the domain, nor does a former service provider retain the right to modify website content after the engagement ends.

Companies should therefore properly manage domain registration information, accounts, and access privileges, and ensure that handover procedures and access revocation are completed when a business relationship ends.

This case serves as a reminder that even when domain management is outsourced, companies still need to know under whose name the domain is registered, who has access to the management account, who must approve changes, and whether operational records are being retained.

When cooperation ends, companies should complete the handover process and revoke access rights. In the event of a dispute, they should also be able to preserve evidence and regain control over the domain.

By defining these requirements in outsourcing arrangements from the outset, accountability can extend beyond the term of the partnership and continue into incident response and post-incident handling.

For authorization involving important digital assets such as domain names, Yu also recommends introducing corresponding accountability procedures.

She noted that such procedures can now be implemented more easily through available services and technologies. TWNIC’s Registry Lock service is one example. Registry Lock can directly restrict changes, transfers, and deletion of domain data at the highest level of the registry, such as TWNIC.

Before any change can be made, the designated service administrator must first complete an identity verification process to unlock the domain at the registry level. This also helps prevent unauthorized domain modifications or transfers if a security incident occurs at the registrar level.

With the support of such technical tools, companies can more clearly define who has authority to unlock a domain and who is responsible for reviewing and approving the action, turning human operational risk into clearly attributable responsibility.

▲ TWNIC’s Registry Lock service

Defining Outsourcing Responsibilities in Contracts

Once internal responsibilities have been established, companies must also clearly define responsibility-sharing mechanisms in outsourcing contracts for situations where incidents occur.

Looking back at the disputes that followed the Delta Air Lines disruption, service level agreements (SLAs) should not focus solely on service availability. They should also clearly specify incident notification deadlines, rights to obtain investigation records, and the specific assistance vendors are required to provide during service restoration.

In Taiwan’s financial sector, for example, the Financial Supervisory Commission’s Regulations Governing Internal Operating Systems and Procedures for the Outsourcing of Financial Institution Operation explicitly state that financial institutions retain ultimate responsibility for outsourced operations.

Outsourcing agreements must specify that service providers are required to immediately notify financial institutions of major abnormalities or deficiencies, as well as define material circumstances that may trigger contract termination. Financial institutions are also required to establish contingency plans and transition mechanisms in advance for terminating outsourced arrangements.

The Financial Supervisory Commission has also planned model contractual clauses concerning cybersecurity responsibilities, with notification and other requirements differentiated according to vendor classification.

In other words, services may be outsourced, but responsibility during an incident—and the capability to take control of the situation—cannot be outsourced.

Exercises Should Test More Than Systems

“Beyond policies and contracts, redundancy planning and exercises should not merely be technical tests conducted by the IT department. They should be critical indicators of whether responsibilities across the entire organization can actually be carried out,” Yu said.

In her view, business continuity and live operational exercises are not only intended to verify whether systems can fail over successfully. They are also meant to test whether managers responsible for decision-making, emergency repairs, and customer communications can actually fulfill the roles assigned to them in a crisis.

Taiwan’s financial sector provides a clear example.

In recent years, a major domestic bank experienced repeated large-scale outages affecting ATMs and online banking following problems during data center and core system upgrades. Following an investigation, the Financial Supervisory Commission imposed a fine of tens of millions of New Taiwan dollars and explicitly cited inadequate supervision of outsourced vendors and failure to properly conduct disaster recovery exercises.

The regulator ultimately held the bank’s general manager accountable under the relevant rules.

This real-world enforcement case clearly establishes the bottom line of accountability: regardless of which vendor a company contracts to operate its systems, ultimate responsibility for operational disruption and the burden of resolving the consequences remain with the company’s management.

Digital trust can only be established when three interconnected conditions are met.

Before an incident occurs, services must be verifiable, enabling users to confirm—before providing personal information or making a payment—that the website or email they are interacting with genuinely belongs to the organization.

When an incident occurs, activities must be traceable. Records should show under whose name a domain is registered, who changed which settings, and when those changes were made, so that the sequence of events can be reconstructed.

Once the facts have been established, responsibility must then be accountable, with a designated person empowered to make decisions and oversee the follow-up response.

None of these elements can stand alone. Together, they form a digital trust governance framework with clearly defined roles and responsibilities.

Only by embedding these mechanisms into everyday responsibilities, outsourcing contracts, and operational exercises—and ensuring that users receive a response when problems occur and that someone remains accountable until service is fully restored—can organizations build a digital environment that is genuinely worthy of trust.