Governance provides the structural authority and accountability framework within which risk management and compliance operate. ISO must establish, operate, and continuously improve the integrated governance capability that the organisation’s information security program requires, including the selection and application of the governance frameworks that provide the structural foundation for each discipline.
Security governance is the ISO’s primary accountability. It encompasses the establishment and maintenance of the policies, procedures, standards, roles, and oversight mechanisms through which the organisation’s information security program is directed, controlled, and held to account. The ISO is not simply a participant in security governance. They are its architect and its steward, and the quality of the governance framework they build and maintain is the single most important determinant of the security program’s long-term effectiveness.
The ISO’s governance responsibilities encompass four interconnected activities that must be performed continuously rather than periodically.
Keep reading with a free Eristotle account.
Every document across our Bodies of Knowledge is free to read once you are signed in. No payment, no tier.
