Security strategy alignment

An information security program exists to support business objectives, not the reverse. The governance of information security guidance in ITU-T X.1054 (the ITU twin text of ISO/IEC 27014) names the alignment of information security objectives with business objectives as a thread of governance, and ISACA defines the program as measures implemented based on business requirements and risk analysis. A useful test for any governance decision is whether it advances or obstructs what the business is trying to accomplish.[2][3]

Roles: CISO vs. steering committee vs. board

The board (the governing body) is accountable for the organization's performance and conformance: it sets strategic direction, defines risk appetite and approves the information security strategy. Executive management allocates resources, assigns security roles and establishes the security policy. The CISO is the individual in charge of information security. Steering committees and councils (an ERM steering committee, or CIO and CISO councils in cybersecurity) provide committee-style governance, and a formal risk committee informed by subordinate councils or working groups helps ensure communication among groups such as human resources, legal, auditing and compliance.[4][5][6][7][17]

Security governance frameworks

COBIT is ISACA's framework for the governance and management of enterprise information and technology (I&T), and one of its governance system principles is that governance is distinct from management. Information security governance is one governance area within the organization's overall governance, alongside areas such as IT, quality and finance.[8][9][10]

Business case development

Security initiatives are justified in business terms through a business case: documentation of the rationale for an investment, used to decide whether to proceed and then to manage the investment through its full economic life cycle. A cost-benefit analysis adds the positive factors and subtracts the negative ones to build the business case for a risk response. Top management should ensure information security supports the entity's objectives, and security projects with significant impact are submitted to the governing body for approval.[11][12][13]

Business-aligned answer vs. most technically thorough answer

A useful habit when several options seem plausible is to favor the one grounded in business objectives and risk. ISO/IEC 27014 (published free as ITU-T X.1054) calls for aligning information security objectives with business objectives and for top management to ensure information security supports the entity's objectives. Governance of information security should rest on risk-based decisions, and how much security is acceptable should be based on the organization's risk appetite, so the most thorough technical control is not the best choice if it goes beyond what the risk warrants.[2][13][14]

Security governance vs. security management

Governance sets direction, policy, and oversight (the "what" and "why," typically board/executive level): the governing body sets strategies and policies, monitors performance and evaluates proposals from managers. Management plans, builds, runs and monitors activities in line with that direction (the "how," typically the CISO and team). This domain is about the former.[15][16]