Security Governance
Definition
The set of structures, roles, policies, and accountability mechanisms by which an organisation directs, controls, and monitors its information security activities. Governance answers who decides, what rules apply, and how compliance is verified.
- Scope
- Structures, roles, policies and accountability for information security
- Answers
- Who decides, what rules apply, how compliance is verified
- Level
- Organisational and strategic, above day-to-day operations
Common questions
How does security governance differ from security management?+
Governance sets direction, policy and accountability at the organisational level, while management is the operational work of implementing controls, monitoring systems and responding to incidents within that direction.
What typically goes wrong when governance is weak?+
Security decisions get made ad hoc by whichever team is loudest, budgets and priorities drift from actual risk, and no one is clearly accountable when an incident traces back to a control that was never funded or enforced.
Related terms
- CISO (Chief Information Security Officer)
- The senior executive responsible for developing and maintaining the information security programme. The CISO reports to the board or a board committee...
- Governance, Risk, and Compliance (GRC)
- An integrated discipline that combines governance structures, risk management processes, and compliance monitoring into a unified programme. GRC platforms and frameworks allow...
- Policy Hierarchy
- The layered document set that translates governance intent into operational requirements. Tiers typically run: information security policy, topic-specific policies, standards, procedures, and...
- Risk Appetite
- The amount and type of risk an organisation is willing to accept in pursuit of its objectives, as defined by its governing...
- Three Lines of Defence
- A governance model that separates security responsibility into three distinct layers: operational management that owns controls (first line), risk and compliance functions...