Six Roles, and Every Control Each One Touches.

The Authorizing Official / CISO does no work in this framework and answers for almost all of it. That is the correct shape — the commander owns intent and risk, the staff owns production — and it is only safe where the accountable role reads what it signs. Where it does not, the RACI still passes inspection and nothing anywhere is actually being decided.

Cyber Threat Intelligence cell and SOC / Defensive Operations and Hunt team and Platform and product owners and Governance / RMF / ISSO hold no A at all. For the SOC that is deliberate: every fire it delivers is either pre-authorized in the rules of engagement or escalated, and a SOC holding its own accountability is a SOC that can authorize its own fires. The first time a containment action takes a statutory service offline, the question of who agreed to that needs an answer.

Five controls Responsible, and three of them exist to disprove something the program has claimed — that the routes are enumerated, that the decisive points are out of reach, and that the maneuvers do what the scheme says. A hunt team folded into the SOC keeps the headcount and loses the function.