Security Office Foundations Template

This generic mandate document provides the foundation for a Information Security function, helping organizations to ensure alignment, accountability, and effective risk management throughout their enterprise.

Document Overview #

• Document No: Please issue a unique document number.
• Version: Please state the latest version.
• Effective Date: The date this mandate is effective from.
• Last Updated: Date when this document was last approved by the relevant stakeholders.
• Responsible: Information Security
• Approved By: Chief Executive Officer / Board Members
• Next Review Date: Yearly / Ad-hoc in case of major changes
• Audience: Organization-wide

Vision #

The organization’s vision for Information Security is to achieve business excellence by proactively managing information security risks and building top-tier capabilities within the industry.

Mission Statement #

Our mission is to effectively manage the opportunities and risks associated with both digital and physical sources of information, ensuring the protection of our products, services, and sensitive data, such as intellectual property and personal information. We are committed to continually advancing our security measures to uphold regulatory compliance and promote operational excellence.

The Three Lines of Defense Model #

We achieve our vision by adhering to the widely recognized Three Lines of Defense (3-LoD) model, which offers a structured approach for risk management, effective governance, and strengthening internal controls:

• First Line of Defense – Operational Management: Accountable for risk management and control implementation.
• Second Line of Defense – Information Security, Risk Management, and Compliance: Responsible for providing oversight, establishing frameworks, and supporting efficient risk management practices.
• Third Line of Defense – Internal Audit: Conducts independent evaluations of the effectiveness of risk management and internal control systems.

Information Security operates predominantly within the second line of defense, focusing on overseeing and ensuring the effective mitigation of information security risks and providing independent and strategic advisory to senior management.

Organisational Placement #

The Information Security function, through the Information Security Officer (ISO) reports directly into the Chief Executive Officer (CEO) and the Board.