The Security Consulting function represents the most senior and most strategically consequential expression of the ISO’s advisory capability, operating at the intersection of the organisation’s executive governance, its business strategy, and its security programme to provide the cohesive, forward-looking guidance that neither the technical security operations nor the governance compliance function can supply from their respective operational positions. It is the function through which the security programme’s intelligence reaches the executive decision-making level in the business-relevant terms that strategic decisions require, and through which the business’s strategic direction reaches the security programme with the operational context that the relevant security advisory demands.
The source material’s framing of the Security Consulting function as the trusted partner to the executive team and business units captures the essential governance ambition that the preceding sections of this domain have been building toward: the transition from the security function that the business experiences as the compliance authority whose requirements it must accommodate to the security function that the business values as the strategic adviser whose counsel improves the quality of the decisions it would make with or without the security perspective that the advisory brings. This transition is not achieved through the announcement of the advisory capability’s existence but through the sustained demonstration of the advisory value whose evidence the business’s experience of the Security Consulting function’s engagement accumulates over time.
Translating Security into Business Language #
Keep reading with a free Eristotle account.
Every document across our Bodies of Knowledge is free to read once you are signed in. No payment, no tier.
