Topics in this domain
- Exam Technique: Thinking Like a Security Manager
- Security Governance vs Security Management
- Organisational Culture and Tone at the Top
- Ethics, Codes of Conduct and Accountability
- Integrating Security into Corporate Governance
- Legal, Regulatory and Contractual Requirements
- Due Diligence, Due Care and Legal Liability
- Privacy and Data Protection Governance
- Governance Roles, the CISO and Reporting Lines
- The Security Steering Committee
- The Three Lines Model and Independent Assurance
- Aligning Security Strategy with Business Objectives
- Developing a Security Strategy and Roadmap
- Gaining and Keeping Executive Commitment
- Governing AI and Emerging Technology
- Security Frameworks Compared: NIST CSF, ISO 27001 and COBIT
- Selecting and Implementing a Framework
- Governance Models: BMIS and the Security Balanced Scorecard
- Resource Planning and Security Budgets
- Building a Business Case for Security Investment
- Demonstrating Value and Return on Security Investment
The Security Steering Committee
Why have one?
Security decisions affect every part of the business: budgets, projects, how people work, which suppliers can be used. No CISO can make those decisions alone and expect support. A security steering committee gives business leaders a seat at the table, so security priorities become business priorities.
For the CISM exam, the steering committee is the classic answer to questions about gaining cross-functional support and aligning security with the business.
Who sits on it
- A senior executive sponsor as chair, often the COO, CRO or another executive.
- Business unit heads, who understand priorities and can accept risk for their areas.
- The CISO, who proposes, presents information and coordinates.
- The CIO or IT leadership, responsible for delivery and operations.
- Legal, compliance and privacy, who bring obligations.
- HR and finance, for people and budget questions.
- Risk management, to keep the enterprise view.
- Internal audit may attend as an adviser or observer, but shouldn’t vote, so it can audit the program independently later.
What it does
| Activity | In practice |
|---|---|
| Align | Reviews the strategy and program so they support business objectives |
| Prioritise | Ranks security initiatives and allocates resources |
| Approve | Endorses policies and major changes, ahead of senior management or board approval |
| Resolve | Settles conflicts between security requirements and business units |
| Monitor | Reviews top risks, metrics, incidents and program progress |
| Escalate | Raises risks beyond appetite to executive management and the board |
Making it work
- A written charter: purpose, authority, membership, quorum and meeting frequency.
- Senior members who can commit their departments, not deputies sent to listen.
- Regular meetings with an agenda built around risk and strategy, not technical detail.
- Minutes recording decisions, owners and due dates.
- Follow-up on actions at the next meeting.
Example. A company’s committee meets quarterly, but only IT managers attend and minutes show no decisions. Meanwhile business units buy cloud tools without review. The CISO asks the COO to chair and invites the business heads. Within two meetings, a cloud approval process is agreed and funded.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Best way to gain cross-functional support for security | A steering committee with senior business representation |
| Main purpose of the committee | Align security with business objectives and priorities |
| Who should chair it? | A senior business executive or sponsor |
| Internal audit’s role on the committee | Adviser or observer, not decision-maker |
| Best evidence the committee works | Minutes showing decisions and follow-up |
In short
- A security steering committee brings senior business, IT, legal, HR and risk leaders together to align security with business priorities.
- It's the most effective way to get cross-functional support and resolve conflicts between security and business goals.
- It reviews strategy and policy, prioritises initiatives, monitors risk and program progress, and escalates to the board.
- Membership must be senior and business-led; a committee of only IT and security people can't ensure alignment.
- Internal audit may attend as an adviser but shouldn't make decisions, to protect its independence.
- A charter, regular meetings and recorded decisions are the evidence that it works.
Exam traps
- A committee of IT managers can't ensure business alignment.
- The CISO usually presents and coordinates; a senior business executive should chair.
- Internal audit voting on security decisions would impair its independence.
- A charter alone proves nothing; minutes and follow-up show the committee works.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Who sits on it
1 / 8