Who should own remediation when exposed assets sit inside subsidiaries?

Accountability should sit with the team that owns the affected asset, but the parent security function must coordinate visibility, prioritisation, and validation. When subsidiaries are outside direct corporate IT control, shared ownership is not enough. Security teams need clear assignment of remediation tasks, confirmation that fixes were applied, and a final check that the exposure is actually closed.

Who Should Own Remediation When Exposure Sits Outside Direct IT Control

Ownership should follow the asset, not the org chart. If the exposed asset sits in a subsidiary, the local team closest to the system should execute remediation, because it can change the configuration, rotate the secret, patch the host, or remove the exposure fastest. The parent security function should still drive visibility, standards, prioritisation, and closure evidence.

The practical distinction is between doing the fix and governing the fix. In a holding-company or federated model, central security usually cannot remediate directly, but it can define the required outcome, set deadlines, track status, and confirm that the risk has actually been removed.

That division matters most when the subsidiary has different tooling, change controls, or operational ownership. If remediation is left as a vague shared responsibility, exposures tend to linger because no one has the authority to execute, no one is measured on closure, and no one independently validates the result.

NHI Mgmt Group’s Ultimate Guide to NHIs is a useful reference point for why closure discipline matters: 91.6% of secrets remain valid five days after notification, which shows that notification alone does not equal remediation.

What Good Remediation Ownership Looks Like in a Subsidiary Model

Good ownership is explicit, auditable, and bounded. The subsidiary owner should receive the remediation task, due date, and success criteria; the parent security team should retain oversight of risk acceptance, escalation, and verification. That arrangement avoids both central bottlenecks and local ambiguity.

In practice, the best model is a simple RACI-like split:

Local asset owner: implements the fix and provides evidence.
Local management: clears operational blockers and approves change windows.
Parent security: prioritises the issue, sets minimum remediation standards, and validates closure.
Risk owner or executive sponsor: handles exception decisions when the subsidiary cannot remediate on time.

Verification is the part teams often underinvest in. A ticket marked complete does not prove the exposure is gone. The close-out standard should include a fresh scan, configuration check, or other evidence that shows the exposure no longer exists in the live environment.

When subsidiaries operate semi-independently, accountability should also extend to repeat findings. If the same exposure recurs, the ownership problem is usually not technical, it is procedural: the local team has not been given a durable control obligation, or the parent function has not enforced a remediation SLA.

Risk and Threat Considerations

Subsidiary-owned exposures create a governance gap when central security can see the issue but cannot directly execute the fix. That gap is attractive to attackers because exposed assets often remain reachable longer when remediation depends on cross-entity coordination, change approval, or informal handoff.

Failure mechanism: the asset owner, the remediation executor, and the verifier are not the same party, so the exposure can stay open after the issue is reported, or it can be marked closed without independent proof. In loosely governed subsidiaries, that often leads to delayed rotation, missed patching, or incomplete configuration cleanup.

Impact: the exposed asset remains a live attack path, especially if it contains credentials, public endpoints, or externally reachable services. The result is longer dwell time, higher likelihood of misuse, and weaker confidence that risk has actually been removed.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS 1 — Inventory and Control of Enterprise Assets	Exposed subsidiary assets must be identified and owned before remediation can be assigned.
	CIS 17 — Incident Response Management	Remediation handoff, escalation, and validation are core response coordination tasks.
Recommendation — Inventory subsidiary assets and assign clear remediation ownership for every exposed system. Coordinate cross-entity response, track closure, and validate that exposure is actually removed.
NIST CSF 2.0	GV.RM — Risk Management Strategy	Subsidiary exposures need a clear ownership and escalation model across the group.
	ID.AM — Asset Management	Ownership depends on knowing which subsidiary asset is exposed and who operates it.
	RS.MI — Incident Mitigation	Exposure closure requires mitigation execution and follow-up verification, not just notification.
Recommendation — Define who owns remediation, escalation, and exception approval across subsidiaries. Maintain asset ownership records that tie each exposed asset to a responsible remediation team. Track mitigation through to verified closure for every exposed subsidiary asset.

Practitioner Guidance

What to prioritise: assign one accountable remediation owner at the subsidiary level for the fix, then assign one central security owner for tracking and validation. Do not accept “shared ownership” as the final state, because shared ownership often means no enforceable deadline and no closure evidence.

What to verify: require proof that the exposure is closed in production, not just that a ticket was updated. For subsidiary assets, the safest close-out standard is an independently checked post-remediation state, ideally using the same detection method that found the exposure in the first place.

Practitioner takeaway: remediation ownership should sit where the asset can be changed, but remediation authority should sit where the risk can be governed and independently confirmed.