The Three Lines of Defence is a governance model that divides responsibility for risk into three layers: operational teams own and manage the risk, risk and compliance teams monitor and challenge controls, and independent audit provides assurance that the first two lines are working. In cyber security, this structure helps avoid a common failure mode: the same team that builds or runs a system should not be the only team deciding whether it is safe.
The model matters because cyber risk is both technical and organizational. Secure configuration, access control, incident response, and supplier oversight need clear owners, but they also need review, testing, and escalation paths. In practice, the first line implements controls, the second line sets policy and tracks exceptions, and the third line checks whether evidence, logging, and remediation are real. Strong defenders use this model to catch control gaps early; attackers benefit when roles are blurred and no one is clearly accountable for a weak system or a missed alert.