Security governance is most readily understood as an inward-facing discipline, concerned with the policies, controls, councils, and risk management processes through which the ISO governs the organisation’s own security posture. This understanding is necessary but insufficient. The modern organisation’s security boundaries do not coincide with its legal boundaries, and the ISO who governs only what is directly within the organisation’s control will consistently find that the most damaging security failures originate in the spaces between the organisation and its partners, suppliers, and acquisition targets where governance authority is less certain and security visibility is less complete.
This section addresses three governance contexts in which the ISO must extend the security programme’s governance discipline beyond the organisation’s operational perimeter: the foundational relationship between governance, strategy, and management within the security programme itself; the governance of information security risk in the context of mergers and acquisitions; and the governance of third-party risk across the organisation’s expanding network of supplier and partner relationships. Each context presents distinct governance challenges that the ISO must address with the same rigour and accountability applied to every other dimension of the security governance framework.
Governance as the Foundation of the Security Program #
Before the ISO can govern effectively beyond the organisation’s boundaries, they must have a precise understanding of governance’s foundational role within the security programme itself and the relationship between governance, strategy, and management that determines the programme’s structural integrity.
Keep reading with a free Eristotle account.
Every document across our Bodies of Knowledge is free to read once you are signed in. No payment, no tier.
