For whoever runs IT security. Start with the IT lead checklist (based on ISO 27001 and the GDPR), then use the supporting guides: domain and server hardening, awareness training, data breaches, and single sign-on. Moral Fabric can run this for you or advise you. See the IT Security overview.