Topics in this domain
- Exam Technique: Thinking Like a Security Manager
- Security Governance vs Security Management
- Organisational Culture and Tone at the Top
- Ethics, Codes of Conduct and Accountability
- Integrating Security into Corporate Governance
- Legal, Regulatory and Contractual Requirements
- Due Diligence, Due Care and Legal Liability
- Privacy and Data Protection Governance
- Governance Roles, the CISO and Reporting Lines
- The Security Steering Committee
- The Three Lines Model and Independent Assurance
- Aligning Security Strategy with Business Objectives
- Developing a Security Strategy and Roadmap
- Gaining and Keeping Executive Commitment
- Governing AI and Emerging Technology
- Security Frameworks Compared: NIST CSF, ISO 27001 and COBIT
- Selecting and Implementing a Framework
- Governance Models: BMIS and the Security Balanced Scorecard
- Resource Planning and Security Budgets
- Building a Business Case for Security Investment
- Demonstrating Value and Return on Security Investment
Governance Models: BMIS and the Security Balanced Scorecard
Security as a system
A new tool fails because people find it awkward. A strong policy fails because the culture ignores it. ISACA’s Business Model for Information Security (BMIS) explains why: security depends on organisation, people, process and technology together, and changing one affects the others. It’s a systems-thinking model, not a control framework.
BMIS elements
| Element | Includes |
|---|---|
| Organisation | Structure, strategy, goals, resources |
| People | Employees, contractors, partners; their skills and behaviour |
| Process | How work is done, including security procedures |
| Technology | Systems and tools that support processes |
The six dynamic interconnections
| Interconnection | Links | Meaning |
|---|---|---|
| Governing | Organisation – Process | Policies and oversight shape how processes run |
| Culture | Organisation – People | Shared values decide how people behave |
| Architecture | Organisation – Technology | Technology structure supports the organisation’s goals |
| Emergence | People – Process | New ways of working appear as people use processes |
| Human factors | People – Technology | Usability; how people interact with systems |
| Enabling and support | Process – Technology | Technology makes processes possible |
Using BMIS
BMIS helps the security manager ask the right questions before a change: who will use it, how will processes adapt, does it fit the culture and the architecture?
Example. A bank rolls out a new data loss prevention tool (technology). Staff find it blocks normal work (human factors), invent workarounds (emergence) and managers tolerate them (culture). Thinking it through with BMIS beforehand would have added user testing, process updates and leadership messaging to the plan.
The security balanced scorecard
The balanced scorecard translates strategy into measures from several perspectives, so performance isn’t judged on cost alone. A security version typically uses:
| Perspective | Example measures |
|---|---|
| Business contribution | Risk reduced; incident losses; spend against plan |
| Stakeholders | Business satisfaction with security; audit and regulator findings |
| Internal processes | Time to patch; access review completion; mean time to detect |
| Learning and growth | Skills and certifications; awareness results; maturity progress |
BMIS helps the security manager understand how security fits the business; the scorecard helps measure and report it. Both support governance.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| ISACA model linking organisation, people, process and technology | BMIS |
| BMIS link between organisation and people | Culture |
| BMIS link between people and technology | Human factors |
| Purpose of a balanced scorecard | Measure strategy from several perspectives |
| Weakness of cost-only security reporting | It isn’t balanced; it misses value and capability |
In short
- BMIS (Business Model for Information Security) is ISACA's systems-thinking model: security depends on organisation, people, process and technology together.
- Its four elements are linked by six dynamic interconnections: governing, culture, architecture, emergence, human factors, and enabling and support.
- BMIS explains why changing one element (say, new technology) affects the others (people, processes, culture).
- A balanced scorecard translates strategy into measures from several perspectives, not just financial ones.
- A security balanced scorecard typically covers business contribution, stakeholders, internal processes, and learning and growth.
- Both models support governance: BMIS for understanding, the scorecard for measuring and reporting.
Exam traps
- BMIS isn't a control framework; it's a way of understanding how security fits the business.
- Culture links organisation and people; governing links organisation and process. Don't swap them.
- A scorecard with only cost measures isn't balanced.
- Technology-only solutions ignore the human factors and culture links.
Slides
Click the slide and use the arrow keys. F toggles full screen.
The six dynamic interconnections
The security balanced scorecard