The CEO is responsible for ensuring that there is a routine for security.

If that is not created -> CEO responsibility.

If that is not followed -> top level mgmt responsibility.

And so on, further down the chain.