The security program represents one of the most complex and consequential delivery undertakings an organisation will manage. It spans multiple departments, involves significant financial investment, carries regulatory implications, and must deliver measurable risk reduction outcomes against a threat landscape that does not pause while the program is being implemented. Managing it effectively requires the same disciplines that govern any major organisational program: clear leadership, structured governance, professional project management, dedicated delivery resource, and the active engagement of senior stakeholders with both the authority and the accountability to drive the program to its objectives.
This section establishes the framework through which the security program should be governed, managed, and delivered, including the rationale for information security’s leadership of the effort and the project management structures that will ensure its successful execution.
The Case for Information Security Leadership #
The security program must be led by the information security function. This is not simply an organisational convenience. It is a governance imperative grounded in the unique combination of expertise, cross-functional reach, strategic alignment, and accountability that the information security function brings to the program’s leadership that no other function can replicate.
Keep reading with a free Eristotle account.
Every document across our Bodies of Knowledge is free to read once you are signed in. No payment, no tier.
