Guide to Security Governance
Exploring how this fundamental concept supports much of the CISSP Body of Knowledge
Security Governance is a fundamental concept that underpins much of the CISSP body of knowledge.
To understand IT security governance, let’s start by defining governance and how organizations function. Governance means directing activities and creating plans to achieve goals and objectives. Corporate governance often refers to business structures that include a board of directors and a management team that sets policies and ensures that company-wide goals are defined and managed.
Security governance refers to the system and rules that direct an organization’s security, and is a component of corporate governance.
Alignment
Security governance flows directly from the organization’s mission, goals, and objectives.
Think about it like setting the rules and strategies that guide an organization's security decisions. Security governance is used to make decisions in an organization, support security efforts, and is aligned in every way with the business's strategy, goals, and objectives. It's not just about managing day-to-day security tasks - it's about ensuring that security aligns with business goals, risks are effectively managed, and the company remains compliant with regulations. Security governance is an important foundational concept in the Security and Risk Management domain.
Security Management Planning
Planning is an integral part of security governance, and effective security management planning ensures that an overall security policy is implemented and supported by the board and management. Security management is based on three types of plans: strategic, tactical, and operational. Strategic plans cover a longer term, usually 3-5 years, while tactical plans (usually one year or less in duration) provide details of accomplishing the goals set out in the strategic plan. Operational plans are usually short-term and highly detailed.
Strategy, goals, missions, and objectives support one another in a hierarchical structure. An objective outlines a specific, ground-level effort that helps you achieve a mission. A mission represents a collection of objectives, where one or more missions lead to your goals. When you reach your goals, you are achieving your strategy.
Important Concepts
There are several core concepts that underpin information security and security governance, and in fact, the rest of the CISSP body of knowledge. The first is that ethics matter, and organizations have laws and security policies that are important for maintaining the integrity of data and system security. (ISC)² has a Code of Professional Ethics that you should be familiar with. You should commit the Code of Ethics Canons to memory:
Protect society, the common good, necessary public trust and confidence, and the infrastructure.
Act honorably, honestly, justly, responsibly, and legally.
Provide diligent and competent service to principals.
Advance and protect the profession.
Accountability and Responsibility
Accountability and responsibility are distinct yet interconnected concepts that are often used interchangeably. It’s essential for businesses (and CISSP candidates) to understand the difference to foster a culture of ownership and high performance.
Responsibility focuses on the obligation to perform specific actions or assigned tasks, and multiple people can be responsible for different aspects of a project or process. Responsibility can be delegated to others.
Accountability focuses on outcomes and consequences. One individual or role is usually ultimately accountable for the result of tasks, actions, projects, and outcomes, and that accountability cannot be delegated.
Clear roles and understanding of accountabilities vs responsibilities help reduce confusion and redundancy, improve efficiency and productivity, and enhance decision-making.
Due Care vs Due Diligence
The CISSP is a management-level certification, and the test is in part an exercise in wearing the hat of a manager, CEO, or owner. Being an owner means that you are a business enabler because your priority is to help the business succeed. You do this in part by finding solutions that mitigate risks to the organization’s risk appetite in a cost-effective manner.
For the exam, it also means answering test questions from a management or ownership perspective. What choices maximize business outcomes? The board and senior management are relying on you to present security issues and options in business language, work to reduce risk, and provide the governance and controls that will help the organization fulfill its mission and achieve its goals. You are accountable (have ownership) for this process.
Due care and due diligence are important concepts related to thinking like an owner.
Due Diligence is about establishing a plan, policy, and processes to protect the organization's interests. In other words, it’s knowing what should be done and planning for it. Examples of due diligence include
Doing discovery and risk assessments for an acquisition or merger.
Developing a formalized security structure that includes a security policy, standards, baselines, guidelines, and procedures.
Due Care is the practice of individual activities that maintain or carry out due diligence. Due care is about the legal responsibility within the law or within an organization’s policies to implement controls, follow security policies, and making reasonable choices.
Due care is the responsible protection of assets. Due diligence is the ability to prove due care.
Five Pillars of Information Security
Securing any organization or environment can be complex, but the basic principles are straightforward. The five (5) Pillars of Information Security are confidentiality, integrity, availability, authenticity, and nonrepudiation.
Here’s what those terms mean:
Confidentiality: the principle that objects should not be disclosed to unauthorized subjects, and includes the measures used to ensure the protection of the secrecy of data, objects, and resources.
Integrity: the idea of protecting the reliability and correctness of data, guarding against unauthorized or improper modification or destruction. This includes preventing authorized subjects from making unauthorized modifications (including mistakes).
Availability: authorized subjects should be granted timely and uninterrupted access to objects.
Authenticity: ensuring a transmission, message, or sender is legitimate.
Nonrepudiation: the subject of an activity or who caused an event cannot deny that the event occurred. Nonrepudiation is made possible through identification, authentication, authorization, accountability, and auditing.
Confidentiality, Integrity, and Availability are often referred to as the CIA Triad, and these three principles are the primary goals of secure systems and infrastructure.
Security Policies
Policies, standards, baselines, guidelines, and procedures are important parts of a comprehensive security plan. The top tier of a formalized security documentation hierarchy is the security policy.
Policy: A security policy is a document that defines the scope of security needed by the organization, discussing assets that require protection and the extent to which security solutions should go to provide the necessary protection. It defines the strategic security objectives, vision, and goals, and outlines the organization's security framework.
Standard: A standard is a specific mandate explicitly stating expectations of performance or conformance in the organization. A standard is more descriptive than a policy, defining compulsory requirements for the use of technology and systems, and security controls used throughout the organization.
Baseline: A baseline defines a minimum level of security that every system throughout the organization must meet. Baselines are typically system-specific and may be based on industry or government standards.
Guideline: A guideline is a recommendation on how standards and baselines should be implemented, and serves as an operational guide for security professionals and users. Guidelines are non-compulsory, flexible, and customizable for unique systems or conditions.
Procedure: A procedure is a detailed, step-by-step description of the exact actions necessary to implement a specific security mechanism, control, or solution. Procedures are also known as Standard Operating Procedures or SOPs.
Organizational Roles and Responsibilities
For the exam, be familiar with these six roles:
Senior Manager: the owner, accountable for security, policy authorization, associated resources, and exercising due diligence and due care.
Security Professional: the implementer, responsible for designing and carrying out security solutions based on the security policy. The security pro has functional responsibility for security.
Asset Owner: the classifier or categorizer, usually a high-level manager who is responsible for categorizing or classifying information and determining appropriate asset protection. The asset owner often delegates data management tasks to a custodian.
Custodian: the "doer," responsible for the task of implementing the protection defined by the security policy and senior management.
Auditor: the checker, responsible for reviewing and verifying that the security policy is properly implemented and adequate.
User: anyone who has access to a secured system. The user is responsible for following and upholding the organization's security policy. User access should be limited to only what is strictly necessary to complete their job (AKA the principle of least privilege).
CISSP Security and Risk Management, Part 1: Guide to Security Governance 🔐
IT Security Governance In Practice
To ensure effective security oversight, IT security governance relies on a solid foundation. In practice successful governance is overseen by management via a governance committee.
Setting Up Governance Committees and Roles
Successful IT security governance requires clear oversight and well-defined roles. A cross-functional governance committee with executive authority ensures alignment with corporate planning and enforces compliance. This committee should include representatives from senior management, and functional groups or departments such as legal, human resources, IT leadership, business unit leaders, risk management, and finance. Security must be treated as an organizational priority, not just an IT issue, to ensure its integration across all areas of the business. Cybersecurity is a business risk that needs to be managed alongside other risks, such as those related to finance, natural disasters, and competitors.
Once roles and oversight are established, the next step is to align security governance with the broader corporate strategy.
Aligning Governance with Corporate Strategy
Security governance must integrate seamlessly with corporate decision-making processes. This means using established frameworks, aligning performance metrics, and creating consistent reporting structures. The goal is to support business objectives without introducing unnecessary obstacles.
A key aspect of this alignment is understanding the organization's risk tolerance, as defined by the board of directors and senior management. Security governance committees should communicate effectively with corporate governance bodies to ensure that security considerations are embedded in major business initiatives.
Reporting and documentation should match corporate governance requirements. Standardized formats and schedules simplify reporting efforts and ensure that security receives the attention it deserves from senior leadership.
Creating Governance Structures and Policies
Once governance committees are in place and aligned with an organization’s strategy, the next step is to develop a framework that translates governance principles into actionable policies for day-to-day security operations.
Designing a Governance Structure
A strong governance structure ensures clear lines of authority, from the boardroom down to the operational level. Most organizations use a top-down model, where decisions flow logically through the organization while maintaining oversight at the executive level.
At the board level, directors set the tone by defining the organization’s risk appetite and providing strategic oversight. They approve major security investments, review significant incidents, and ensure that security governance aligns with broader corporate goals. While board members don’t need to be technical experts, they must understand how security risks impact business objectives and shareholder value.
Executive sponsorship bridges the gap between the board and operations. Typically led by the CEO or a designated executive, this role ensures that board directives are turned into actionable priorities. The sponsor allocates resources, resolves barriers, and serves as the escalation point for security issues requiring decisions beyond the Chief Information Security Officer’s (CISO) authority.
The CISO operates at a strategic level, translating executive priorities into specific programs and controls. This role involves managing budgets, overseeing security teams, and reporting progress to leadership. In organizations without a dedicated CISO, IT directors often take on these responsibilities.
Control owners form the operational backbone of the governance structure. These individuals - whether department heads, system administrators, or process owners - are responsible for implementing security controls within their areas of oversight.
To formalize these roles, standardize your security documentation and ensure clarity across the organization.
Conclusion
IT security governance is the system, policies, and goals that ensures an organization’s security strategy aligns with its overall business goals. It flows directly from corporate governance and supports the mission, goals and objectives of the business. Effective governance involves security management planning through strategic, tactical, and operational plans, as well as adherence to ethical standards, accountability, and core principles like confidentiality, integrity, availability, authenticity, and nonrepudiation. Importantly, governance evolves with new technologies and threats, ensuring legal compliance while maintaining stakeholder trust.