Enterprise governance is the overarching framework within which the organisation’s most consequential strategic, operational, and risk management decisions are made. It is the primary responsibility of the board and executive management, who set the organisation’s strategic direction, define its risk appetite, ensure the achievement of its objectives, and allocate its resources in a manner consistent with its long-term sustainability. The ISO does not own enterprise governance. However, the ISO carries a critical and clearly defined responsibility within it: to ensure that information security is embedded as a substantive and actively governed dimension of the organisation’s enterprise governance framework rather than treated as a technical concern that sits outside the board’s direct oversight responsibilities.
Understanding the distinction between owning enterprise governance and operating effectively within it is one of the most important governance competencies the ISO must develop. The ISO who mistakes their role for one of governance authority will create friction with the board and executive management whose cooperation they depend on. The ISO who underestimates their responsibility to engage, inform, and influence at the enterprise governance level will find that information security decisions are made without adequate security input, and that the resources, authority, and cultural conditions the security program requires are not secured. The ISO’s enterprise governance role is one of expert counsel, structured accountability, and persistent advocacy, exercised through the formal governance structures that the board and executive management have established.
Engaging with the Board’s Strategic Direction Function #
The board’s responsibility for setting the organisation’s strategic direction creates both an obligation and an opportunity for the ISO. The obligation is to ensure that the board’s strategic decisions are informed by an accurate and current understanding of the information security implications they carry. Strategic decisions about market expansion, digital transformation, mergers and acquisitions, new product development, and technology adoption all have security dimensions that must be assessed and communicated to the board before strategic commitments are made rather than after implementation has begun.
Keep reading with a free Eristotle account.
Every document across our Bodies of Knowledge is free to read once you are signed in. No payment, no tier.
