4.4Management and Security Governance

Earlier chapters focused mainly on frontline controls; this section raises the vantage point to cover how executives take responsibility for and govern security. As a capstone to SG, understand how individual controls connect to management-level decision-making.

4.4.1Information security governance and corporate governance

• Information security governance is a mechanism, led by management, that makes policy decisions, resource allocation, and monitoring for information security function across the whole organization. Its core is that management itself recognizes the risk and bears accountability, rather than leaving it to the front line. Where the ISMS (Chapter 2) is the mechanism for "how to operate," governance is the higher-level view that management is responsible for making that mechanism function.
• Corporate governance is the mechanism by which shareholders, the board of directors, and others oversee management's conduct of the business and ensure transparency and soundness. Information security governance is positioned as part of corporate governance—its concretization in the IT/security domain. Internal control (section 2 of this chapter) is the mechanism management establishes and operates to ensure proper business conduct, and it is one component supporting corporate governance.