### Information Security Governance Information security governance is a natural extension of corporate governance. The board delegates operational authority to the CEO, who then delegates specific areas of authority to subordinate executives. For example, the CEO might delegate financial authority to the chief financial officer (**CFO**) and operational authority to the chief operations officer (**COO**). Similarly, the CEO delegates information security responsibility to the chief information security officer (**CISO**) or other responsible executive. This hierarchical approach to governance helps ensure that information security governance efforts are integrated into corporate governance efforts, ensuring that the organisation's information security program supports broader organisational goals and objectives. The CISO and CEO must work together to ensure the proper alignment of the information security program with corporate governance. The CISO then works with other peers on the senior management team to design and implement an information security governance framework that guides the activity of the information security function and ensures alignment with the organisation's information security strategy. This governance framework may take many different forms. It normally involves the establishment of a management structure for the cybersecurity team that aligns with management approaches used elsewhere in the organization. The information security governance framework should also include the mechanisms that the security team will use to enforce security requirements across the organization. This is particularly important because the CISO does not exercise operational control over the entire organization but needs management leverage to ensure the organization meets its cybersecurity requirements. This is normally done through the creation of policies that apply to the entire organisation. ### Types of Governance Structures The governance model described below is the one most commonly used in for-profit businesses, but many organisations have their own unique approaches to security governance. These approaches fit into two major categories: - **Centralised** governance models use a top-down approach where a central authority creates policies and standards, which are then enforced throughout the organization. - **Decentralised** governance models use a bottom-up approach, where individual business units are delegated the authority to achieve cybersecurity objectives and then may do so in the manner they see fit. In addition to using a formal board of directors, governance structures may incorporate a variety of internal committees consisting of **subject matter experts** (*SMEs*) and managers. Government entities, such as regulatory agencies, may also play a role in the governance of some organisations. For example, banks may be regulated by the U.S. Treasury Department or similar agencies in other countries. ## Understanding Policy Documents An organisation's information security policy framework contains a series of documents designed to describe the organisation's cybersecurity program. The scope and complexity of these documents vary widely, depending on the nature of the organisation and its information resources. These frameworks generally include four types of document: - Policies - Standards - Procedures - Guidelines The definitions of these categories vary significantly from organisation to organisation and it is very common to find the lines between them blurred. Though at first glance that may seem incorrect, it's a natural occurrence as security theory meets the real world. As long as the documents are achieving their desired purpose, there's no harm and no foul. As you prepare the documents in your policy framework, you should not only take into account your organisation's business objectives but also consider external considerations that may impact your policies. These include: - Regulatory and legal requirements that mandate the use of certain controls - Industry-specific considerations that may alter your approach to information security - Jurisdiction-specific considerations based on global, national, and/or local/regional issues in the areas where you operate ### [[Policies]] ### [[Standards]] ### [[Procedures]] ### [[Guidelines]] ### [[Exceptions and Compensating Controls]] ### [[Monitoring and Revision]]