Information security governance
- Term
- Information security governance
- Exam
- CISM
- Definition
The leadership, structures and processes ensuring security supports business objectives and manages risk.
- Explained
Security governance is how the board and senior management direct and oversee security: setting strategy, appetite, accountability and resources, and monitoring results. It is distinct from security management, which plans and runs the program.
- In practice
A board risk committee reviews security risk against appetite each quarter.
- Often confused with
- Security management
- Exam angle
The board and senior management are accountable.
- Related