Security governance

Governance sets direction and accountability. It covers guidelines, policies, standards, and procedures; external considerations such as regulations; monitoring and revision; governance structures; and the roles of owners, controllers, processors, and custodians.

Documents

Common policies include acceptable use (AUP), information security, business continuity, disaster recovery, incident response, software development life cycle (SDLC), and change management. Procedures include onboarding and offboarding and playbooks.

Structures and roles

Governance can sit with boards, committees, government entities, or be centralized or decentralized. External considerations include regulatory, legal, industry, and local, regional, national, and global requirements. Documents must be monitored and revised as threats, laws, and the business change.

Key terms

Policy

A high-level, mandatory statement of an organization's security intent and rules.

Standard

A specific, mandatory requirement that supports a policy, such as a minimum setting.

Procedure

Step-by-step instructions for carrying out a task consistently.

Guideline

Recommended, non-mandatory advice for good practice.

Acceptable use policy (AUP)

A policy defining how employees may and may not use company systems and data.

Data owner

A senior person accountable for a data set, including its classification and access approval.

Data controller

The party that decides why and how personal data is processed.

Data processor

A party that processes personal data on behalf of and under instructions from a controller.

Data custodian

The role responsible for day-to-day handling, storage, and protection of data.

Business continuity policy

A policy that sets how the organization will keep critical functions running during disruption.

Centralized governance

A structure where one central group sets and enforces security decisions for the whole organization.