Strategic Priority: Defining and Structuring the IS Organisation

The structure of the information security organisation is one of the most consequential governance decisions an organisation makes. A well-constructed security organisation ensures that the right capabilities are in place, that accountability is clearly defined, and that security is integrated into every dimension of the business rather than operating as an isolated technical function. Equally, a poorly designed structure, one that lacks independence, misaligns reporting relationships, or fails to reflect the organisation’s actual size and risk profile, will undermine even the most thoughtfully constructed security strategy. The goal is not to replicate a generic template but to design an organisation that is calibrated to the specific size, industry, complexity, and risk landscape of the enterprise, always with the overarching objective of aligning security capabilities with business outcomes.

Select the Operating Model #

The first and most foundational decision is the operating model within which the security organisation will function. This choice determines how authority, accountability, and capability are distributed across the enterprise and shapes every subsequent structural decision. Organisations should evaluate three principal models, recognising that the right choice depends on their size, geographic footprint, operational complexity, and regulatory environment.

Centralised Model #

The centralised model places all security decision-making, policy-setting, and operational capability within a single central function, providing maximum consistency and a single point of accountability for the security programme.

Advantages of this model include a high degree of process consistency and reliability, the elimination of duplicated effort, the ability to redeploy resources rapidly in response to changing priorities, and the cost efficiency that consolidated capability enables.

Limitations include reduced influence over security effectiveness within individual business units, higher effort required to drive security improvement at the operational level, limited business-specific expertise, and the risk that dissatisfied business units develop their own informal security capabilities, reducing the central function’s visibility and control.

Hybrid Model #

The hybrid model combines central governance and standard-setting with local implementation capability, seeking to balance the consistency of centralisation with the responsiveness of local presence.