The model is implemented as a binding measure when defining roles and responsibilities as part of the process of documenting informa­ tion security activities, as well as during operations in practice.