Setting up an effective information security function within a business requires careful consideration of several key principles, which we call Tenets. These tenets help ensure that the security function aligns with organisational goals, addresses potential risks, and fosters a culture of security awareness. Together they form the philosophical and practical foundation upon which a mature, sustainable, and business-aligned security programme is built. Each tenet is explored in depth elsewhere in this Body of Knowledge; what follows is a brief introduction to each and why it matters.
T01: Adopt a Risk-Based Approach #
Not all risks are equal, and no organisation has unlimited resources to address every vulnerability. A risk-based approach provides the analytical foundation for making sound, defensible decisions about where to invest, what to prioritise, and what level of residual risk is acceptable. This tenet calls for the establishment of a structured Information Security Management System (ISMS) that systematically identifies, assesses, and mitigates risks to information assets, with controls applied in proportion to the sensitivity and criticality of the data and systems involved. Without this discipline, security effort becomes reactive, inconsistent, and difficult to justify to senior stakeholders.
T02: Align with Business Values and Objectives #
Security that operates in isolation from the business it is designed to protect will always struggle for relevance, investment, and support. This tenet establishes the principle that information security must be understood and delivered as a business enabler, not a constraint. Security strategies, priorities, and investments should be grounded in a clear understanding of what the organisation values, what it is trying to achieve, and what risks it is willing to accept in pursuit of its goals. ISOs who align their programmes with business objectives earn the credibility and organisational backing needed to drive meaningful and lasting change.
Keep reading with a free Eristotle account.
Every document across our Bodies of Knowledge is free to read once you are signed in. No payment, no tier.
