Per the Financial Administration Act, deputy heads are designated as accounting officers responsible for the prudent management of their departments. That includes security management. By dint of being a deputy minister, those individuals inherit responsibility for the security of their organizations and of their people. Because of that, it flows from there that they are the ones ultimately accountable within their organizations for the decisions they make.
Treasury Board policy flows from that and informs them how they exercise their security responsibilities, but it is the Financial Administration Act that puts that responsibility on them.