The second line of defense in cybersecurity includes:

The Three Lines of Defense model delineates governance and risk management roles. The second line consists of functions that oversee risk, such as risk management and compliance. Its primary role is to provide oversight of the first line (operational management) by establishing policies, frameworks, and monitoring controls to ensure they are designed and operating effectively. This includes risk management monitoring and measuring control effectiveness, which provides a challenge function to the first line and support to the third line. This oversight is crucial for maintaining the organization's risk posture.

A. Control self-assessments are a first-line-of-defense activity where operational management assesses its own controls.
C. Separate reporting to the audit committee is a key characteristic of the third line of defense (internal audit) to ensure independence.
D. Penetration testing is a technical control assessment that can be performed by any line, but risk oversight is the defining role of the second line.

1. ISACA (2021). Cybersecurity Audit Certificate Study Guide, 2nd Edition. Section: Governance, "Three Lines of Defense Model," pp. 18-19.

2. The Institute of Internal Auditors (IIA) (2020). The IIA’s Three Lines Model. Position Paper, July 2020, p. 4.

3. ISACA (2019). COBIT 2019 Framework: Governance and Management Objectives. APO01 Managed I&T Management Framework, p. 51.