According to the CRISC Review Manual (Digital Version), the security management function is responsible for ensuring that effective cybersecurity controls are established and maintained. The security management function should:
Define the cybersecurity strategy and objectives aligned with the enterprise's risk appetite and business goals Establish and maintain the cybersecurity policies, standards, procedures and guidelines Implement and monitor the cybersecurity controls and processes Coordinate and communicate with other stakeholders, such as risk owners, IT management, enterprise risk function, internal and external auditors, regulators and third parties Report on the cybersecurity performance and risk posture to senior management and the board Continuously improve the cybersecurity capabilities and maturity References = CRISC Review Manual (Digital Version), Chapter 1: IT Risk Identification, Section 1.4: IT Risk Management Roles and Responsibilities, pp. 29-301

According to the ISACA Risk and Information Systems Control study guide and handbook, the control owners in the IT department should determine whether risk responses still effectively address risk after a restructuring and outsourcing of certain functions. This is because the restructuring and outsourcing may have changed the risk profile, the control environment, and the control activities of the IT department. The control owners should review the existing risk responses and evaluate if they are still appropriate, adequate, and efficient in mitigating the risks associated with the outsourced functions. The control owners should also monitor the performance and compliance of the service providers and ensure that the contractual obligations and service level agreements are met12
1: ISACA Risk and Information Systems Control Study Guide, 4th Edition, page 33 2: ISACA Risk and Information Systems Control Handbook, 1st Edition, page 25

A risk practitioner is preparing a report to communicate changes in the risk and control environment, such as new or emerging risks, changes in risk levels, risk responses, or control effectiveness. The best way to engage stakeholder attention is to include a summary linking information to stakeholder needs, meaning that the report should highlight the key points and findings that are relevant and important for the stakeholder's role, responsibility, and interest. The summary should also explain how the information affects the stakeholder's objectives, expectations, and decisions. The summary should be concise, clear, and compelling, and should capture the stakeholder's attention and interest. The report can also include detailed deviations from industry benchmarks, a roadmap to achieve operational excellence, or an option to publish the report on-demand for stakeholders, but these are not the best ways to engage stakeholder attention, as they may not be directly related to the stakeholder's needs or may overwhelm the stakeholder with too much information. References = Risk and Information Systems Control Study Manual, Chapter 3, Section 3.4.1, p. 124-125