A security program spans several countries and business units. What best supports consistent accountability?

1. A single unassigned global mailbox
2. Named control owners and clear responsibilities within a common governance framework
3. Different undocumented rules for every project
4. Only the CISO's personal task list