The preceding domains of this publication have addressed the governance, risk management, compliance, and security culture disciplines through which the ISO establishes the frameworks, manages the risks, meets the obligations, and develops the human capability that the organisation’s information security requires. This domain addresses the dimension of the ISO’s role that is most consequential for the organisation’s long-term security effectiveness and most rarely addressed in the technical and governance literature that the profession has historically produced: the advisory and consulting function through which the ISO translates the security programme’s intelligence, frameworks, and standards into the practical business guidance that enables the organisation’s strategic and operational decisions to be made with the security awareness that their security implications demand.
The security consulting role requires a fundamental reorientation in how the ISO understands their professional function. The governance ISO governs the framework. The risk management ISO identifies and treats the risks. The compliance ISO meets the obligations. The security consultant ISO works alongside the business to ensure that the decisions the organisation makes in pursuit of its strategic objectives are informed by the security considerations that those decisions create and enable rather than constrained by the security requirements that the compliance-oriented approach imposes upon them. The distinction is not merely rhetorical. It is the operational difference between the security function that the business experiences as the obstacle that slows its decisions and the security function that the business experiences as the adviser that improves them.
The Case for the ISO as Trusted Business Adviser #
The information security function’s traditional positioning within the organisation has been primarily defensive and reactive, responding to the security incidents that occur, enforcing the policies that the governance framework requires, and assessing the risks that the risk management process identifies. This positioning has served the compliance function adequately but has consistently failed to provide the strategic value that the security function’s intelligence and expertise could deliver if the advisory relationship with the business were actively cultivated.
Keep reading with a free Eristotle account.
Every document across our Bodies of Knowledge is free to read once you are signed in. No payment, no tier.
