Information Security Governance · Topic 1 of 2
Enterprise Governance, Culture, Requirements and Roles
Security culture, legal, regulatory and contractual requirements, and the roles of the board, senior management, the security manager and risk owners.
- 3 min
- Governance aligns security with business objectives and risk appetite.
- Culture is shown by behavior; executive support drives it.
- Legal interprets requirements; the security manager maps them to controls.
What it is
Information security governance is the part of enterprise governance that sets direction for security, makes sure risks are managed within the organization's appetite and holds people accountable. It depends on three things: an organizational culture that values security, a clear view of the legal, regulatory and contractual requirements the organization must meet, and structures and roles that say who decides and who does what.
How it works
Organizational culture
Culture is how people actually behave when no one is checking. A security-aware culture shows in staff reporting incidents, managers treating security as part of business decisions and leaders modelling good behavior.
The security manager influences culture through visible executive support, awareness and training, simple and usable policies, recognizing good behavior and fitting security into existing business processes. Culture change is slow; it is measured through behavior, such as reporting rates, not just training completion.
When a question says controls are routinely bypassed, the root cause is often culture or business alignment, not the lack of another technical control.
Legal, regulatory and contractual requirements
| Source | Examples |
|---|---|
| Laws and regulations | Data protection and privacy laws, breach notification rules, sector regulations |
| Contracts | Customer security clauses, card payment obligations, service provider terms |
| Internal commitments | Policies and standards the organization has adopted |
The security manager makes sure there is a process to identify applicable requirements, usually with legal and compliance functions, interpret them, map them to controls and monitor for change. Legal counsel interprets the law; the security manager turns the interpretation into controls. Requirements that apply in several countries can conflict, and decisions about them need legal input.
Roles and responsibilities
| Role | Responsibility |
|---|---|
| Board of directors | Ultimately accountable for governance; sets risk appetite; oversees through reporting |
| Senior management (executives) | Sponsors the program, approves strategy and policy, provides resources |
| Steering committee | Cross-functional group that prioritizes and coordinates security across the business |
| Information security manager or CISO | Develops strategy, runs the program, advises management, reports on risk |
| Business process and data owners | Accountable for their information; decide classification and access; accept risks within their authority |
| Risk owners | Accountable for managing specific risks |
| Custodians and IT | Implement and operate controls |
| Internal audit | Provides independent assurance |
| Users | Follow policy and report incidents |
A RACI chart (responsible, accountable, consulted, informed) makes roles clear and avoids gaps and overlaps.
Where security reports
The security function should report at a level that gives it enough independence and authority to raise issues with senior management. When the security manager reports to the CIO, conflicts of interest can arise between delivery and security; an independent reporting line or a direct channel to a risk committee helps.
How the exam asks about this
- "Who is ultimately accountable for information security?" The board and senior management.
- "Who should decide the classification of a data set?" The data owner.
- "A new regulation applies. What should the manager do FIRST?" Get legal's interpretation of how it applies, then perform a gap analysis.
What to remember for the exam
- Governance aligns security with business objectives and risk appetite.
- Culture is shown by behavior; executive support drives it.
- Legal interprets requirements; the security manager maps them to controls.
- The board is accountable; owners accept risk; IT implements.
- Clear roles (for example a RACI) prevent gaps.
Making the security manager the owner of business risks takes accountability away from the people who run the business and can accept or treat those risks.
Common mistakes
Treating governance as an IT task. It starts at the board.
Interpreting laws without legal counsel.
Measuring culture by training completion only.
Check yourself
Who is ultimately accountable for information security governance?
The board of directors, with senior management.
What role does the data owner have?
The data owner is accountable for the information, decides its classification and approves access.
What should the security manager do first when a new regulation is announced?
Obtain legal's interpretation of how it applies to the organization, then assess gaps against current controls.
Topic 1 of 2 in Information Security Governance
Test yourself on Information Security Governance
The full ISACA CISM question bank has 1,044 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.