The governance disciplines described throughout this section of the publication establish what the ISO must build, how it must be structured, and what it must contain. This final section addresses a dimension of governance leadership that is equally important and more difficult to sustain: ensuring that the governance framework the ISO has built actually delivers the outcomes it was designed to achieve, and that those outcomes are measured, reported, and continuously improved with the rigour that distinguishes governance that genuinely protects the organisation from governance that merely satisfies auditors and regulators.
The ISO must reject the compliance-first conception of security governance that pervades many organisations, in which the governance framework’s success is measured by the completion of required activities rather than by the security outcomes those activities produce. A governance framework that generates comprehensive documentation, passes annual audits, and satisfies regulatory requirements while failing to reduce the organisation’s actual risk exposure or to build the security culture that sustained resilience requires is not an effective governance framework. It is an effective compliance programme, and the difference matters enormously both for the organisation’s security and for the ISO’s professional credibility.
Results-oriented governance requires the ISO to make four commitments that go beyond the structural disciplines of framework design and policy management that the preceding sections have addressed.
Embedding Security Governance in Business Strategy #
The ISO’s most strategically significant governance responsibility is ensuring that security governance is woven into the organisation’s strategic planning and decision-making processes rather than operating as a parallel function that intersects with the business only at the points where compliance requires it. Security governance that is not embedded in business strategy will always be reactive, always be underfunded relative to its requirements, and always be perceived by the organisation as an external imposition rather than an intrinsic business capability.
Keep reading with a free Eristotle account.
Every document across our Bodies of Knowledge is free to read once you are signed in. No payment, no tier.
