Topics in this domain
- Exam Technique: Thinking Like a Security Manager
- Security Governance vs Security Management
- Organisational Culture and Tone at the Top
- Ethics, Codes of Conduct and Accountability
- Integrating Security into Corporate Governance
- Legal, Regulatory and Contractual Requirements
- Due Diligence, Due Care and Legal Liability
- Privacy and Data Protection Governance
- Governance Roles, the CISO and Reporting Lines
- The Security Steering Committee
- The Three Lines Model and Independent Assurance
- Aligning Security Strategy with Business Objectives
- Developing a Security Strategy and Roadmap
- Gaining and Keeping Executive Commitment
- Governing AI and Emerging Technology
- Security Frameworks Compared: NIST CSF, ISO 27001 and COBIT
- Selecting and Implementing a Framework
- Governance Models: BMIS and the Security Balanced Scorecard
- Resource Planning and Security Budgets
- Building a Business Case for Security Investment
- Demonstrating Value and Return on Security Investment
Security Governance vs Security Management
Why security needs governance
For most organisations, information is now among their most valuable assets: customer records, designs, financial data, the systems that run operations. Losing it, leaking it or having it corrupted can mean fines, lawsuits, lost customers and, sometimes, the end of the business.
Decisions about how much to protect that information, and how much risk to accept, are business decisions. They involve money, legal exposure and strategy. That puts them in the hands of the board and senior management, not just the IT or security department. Information security governance is how they exercise that responsibility.
Example. A retailer’s IT team runs good firewalls and patching. But nobody has decided which data matters most, how much risk the business can live with, or who answers for a breach. When customer data leaks through a supplier, the board discovers it never set any direction at all. The technical work was fine; governance was missing.
Governance vs management
| Governance | Management | |
|---|---|---|
| Who | Board and senior management | CISO, security manager and team |
| Does what | Sets direction and risk appetite, assigns accountability and resources, monitors | Plans, builds and runs the program and its controls |
| Asks | Are we protecting the right things, to the right level? | Are the controls working and the risks managed? |
| Output | Strategy, policy direction, risk appetite, oversight | Program, standards, controls, metrics, reports |
Information security governance is a subset of corporate governance, in the same way financial governance is. COBIT calls the governance activities evaluate, direct and monitor, and the management activities plan, build, run and monitor.
What good governance delivers
ISACA describes six outcomes of effective security governance:
- Strategic alignment: security supports the business strategy and objectives.
- Risk management: risks are understood and kept within the organisation’s appetite.
- Value delivery: security investments are worth what they cost.
- Resource optimisation: people, technology and knowledge are used efficiently.
- Performance measurement: metrics show whether objectives are being met.
- Assurance integration: security, audit, risk, legal, HR, physical security and others work together rather than in silos.
Who is accountable for what
| Role | Main job |
|---|---|
| Board of directors | Accountable for protecting information assets; sets direction and risk appetite; oversees |
| Executive management | Puts the board’s direction into practice; provides resources; sets the tone |
| Security steering committee | Senior cross-functional group that aligns security with business priorities |
| CISO / information security manager | Develops, runs and reports on the security program |
| Business and data owners | Own their information, decide its classification and accept its risk |
The board can delegate the work but not the accountability. The CISO is responsible for running the program; the board answers for the outcome.
Signs governance is working
- The board discusses security risk regularly, in business terms rather than technical ones.
- A documented strategy links security objectives to business objectives.
- Risk appetite is defined, and treatment decisions are made against it.
- Roles and accountability are assigned and understood.
- Metrics show progress, and management acts on them.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Who is ultimately accountable for information security? | The board / senior management |
| Most important factor for effective security governance | Senior management commitment and support |
| What should drive security governance? | Business objectives and strategy |
| Primary goal or outcome of security governance | Strategic alignment with the business |
| Which activity is governance rather than management? | Setting direction, risk appetite and accountability |
In short
- Information security governance is the board and senior management setting direction, deciding risk appetite, assigning accountability and monitoring results.
- Security management is the CISO and team turning that direction into a program, controls and day-to-day decisions.
- Governance is part of corporate governance. Accountability for protecting information sits with the board, not the IT department.
- Six outcomes of good governance: strategic alignment, risk management, value delivery, resource optimisation, performance measurement and assurance integration.
- The most important ingredient is senior management commitment; without it, the program has no authority or money.
- Governance asks 'are we protecting the right things, to the right level?'; management asks 'are the controls working?'.
Exam traps
- The CISO manages security; the board is accountable for it. Don't confuse responsibility with accountability.
- Governance isn't a technical activity. Buying tools or writing firewall rules is management, not governance.
- Security governance is driven by business objectives, not by the latest threats or by technology.
- A strong security team with no board oversight is a governance gap, even if operations look fine.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Governance vs management
What governance should deliver