Security and Risk Management · Topic 2 of 7
Security Governance Principles
Aligning security with business strategy, organizational processes, roles and responsibilities, control frameworks, and due care versus due diligence.
- 3 min
- Governance is direction and oversight by senior management; they are accountable.
- Strategic, tactical and operational plans align security to the business.
- Owners decide; custodians implement.
What it is
Security governance is how senior management directs and controls security so it serves the organization's goals. It sets strategy, assigns responsibility, chooses frameworks and checks that security is working. Governance answers "are we doing the right things?"; management answers "are we doing things right?".
How it works
Alignment with the business
Security must support the business strategy, goals, mission and objectives. A security program that blocks the business without a risk reason will be bypassed. Plans work at three horizons:
| Plan | Horizon | Example |
|---|---|---|
| Strategic | About three to five years | Move to zero trust, build a security operations center |
| Tactical | About a year | Deploy multifactor authentication this year |
| Operational | Weeks to months | Patch schedules, daily procedures |
Organizational processes
Security has a role in:
- Acquisitions and mergers: assess the other organization's security before and after the deal; plan how networks and identities will join.
- Divestitures: separate data, accounts and systems cleanly; retrieve or wipe what leaves.
- Governance committees: a steering committee with business leaders sets priorities and approves risk decisions.
Roles and responsibilities
| Role | Responsibility |
|---|---|
| Senior management / board | Ultimately accountable for security and risk |
| CISO | Leads the security program; ideally reports outside IT to avoid conflicts of interest |
| Data owner | Business person accountable for a data set: classification and who may access it |
| Data custodian | Implements the owner's decisions: backups, permissions, technical controls |
| System owner | Accountable for a system that processes data |
| Users | Follow policy and protect what they handle |
| Auditors | Independently check that controls work |
Accountability cannot be delegated; responsibility can. Senior management remains accountable even when tasks are assigned to others.
Security control frameworks
| Framework | Purpose |
|---|---|
| ISO/IEC 27001 | Requirements for an information security management system (certifiable) |
| ISO/IEC 27002 | Guidance on information security controls |
| NIST Cybersecurity Framework | Outcomes organized by functions (Govern, Identify, Protect, Detect, Respond, Recover in version 2.0) |
| NIST SP 800-53 | Catalog of security and privacy controls |
| COBIT | IT governance and management |
| SABSA | Business-driven security architecture |
| PCI DSS | Requirements for protecting payment card data |
Choose a framework that fits the organization's size, industry and regulators, then tailor it.
Due care and due diligence
| Term | Meaning | Example |
|---|---|---|
| Due diligence | Investigating and understanding risks before acting | Assessing a vendor before signing |
| Due care | Doing what a reasonable person would do to protect assets | Patching, enforcing policy, training staff |
Failing at either can make the organization negligent.
Measuring and reporting
Governance needs evidence: metrics, key performance and risk indicators, audits and regular reports to the board. Security reporting should be in business terms: risk, cost and impact.
How the exam asks about this
- "Security findings are softened because the CISO reports to the CIO." Move the reporting line outside IT.
- "Who decides who may access this data?" The data owner.
- "What is due diligence?" Research and assessment before a decision.
What to remember for the exam
- Governance is direction and oversight by senior management; they are accountable.
- Strategic, tactical and operational plans align security to the business.
- Owners decide; custodians implement.
- Know the major frameworks and what each is for.
- Due diligence is researching; due care is acting responsibly.
Security that does not align with business objectives loses support. Answers that ignore the business context are usually wrong.
Common mistakes
Letting IT decide data access. The business owner decides.
Mixing up due care and due diligence.
Treating a framework as one-size-fits-all. Frameworks are tailored to the organization.
Check yourself
Who is ultimately accountable for security in an organization?
Senior management and the board.
What is the difference between a data owner and a data custodian?
The owner decides classification and access; the custodian implements and maintains the controls.
Which ISO standard specifies the requirements for a certifiable information security management system?
ISO/IEC 27001.
Topic 2 of 7 in Security and Risk Management
Test yourself on Security and Risk Management
The full ISC2 CISSP question bank has 1,113 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.