We’re not in an information age anymore. We’re in the information management age. ~ Chris Hardwick.
Information governance is a corporation’s core information policy. The IT Governance Institute (ITGI) defines governance as:
“The set of responsibilities and practices exercised by the board and executive management to provide strategic direction, ensure that objectives are achieved, ascertaining that risk is managed appropriately and verifying that the enterprise’s resources are used responsibly.”
The method of organizing, guiding, monitoring, and affecting strategic decisions, activities, and behaviors is known as information security governance (ISG). One of the goals of information security governance is to assure that the security framework is correct and reaches the organizational vision.
By Irfan Shakeel, Founder and Lead Trainer at EH Academy
Information security governance is a collection of standardized modules; that promises top management that the companies’ primary goals reflect their overall security. Once the modules are in position, executives get confident that efficient information security protects the firm’s most sensitive and valuable resources.
The Information Security Governance Ensures:
- Strategic alignment: It is aligned with the corporate plan to achieve goals.
- Risk management: Decreases threat and severe consequences to decent amounts.
- Value delivery: Getting the best out of security expenditures to achieve targets.
- Resource optimization: Security skills and services use wisely.
- Performance measurement: Monitoring and supervising are done to confirm the achievement of goals.
- Integration: Incorporate assurance components to enhance the operations run smoothly from stem to stern.
Roles and Responsibilities
Information security governance necessitates thorough planning and implementation. It requires dedication and assets, along with delegating responsibility to professionals for information security. Information security governance allows the committee to assess whether the corporation’s priorities are achieved or not. Following is a list of the various positions and responsibilities:
- The Senior Management oversees providing overall information security governance guidance and assistance.
- Executive management is responsible for defining operational security goals and setting efficient security governance to accomplish them.
- The Chief Information Security Officer (CISO) oversees designing security policy, overseeing business security operations, and engaging with business owners.
- Security Steering Committee (SSG) identifies the security plan and implementation efforts. Particularly an attempt to align security with company unit operations.
Chief Information Security Officer (CISO)
Company with the most security issues, professional leadership is still needed. The CISO’s job is to do the same. As a part of the leadership board, the CISO is known as a mentor, trainer, and security leader. The CISO oversees and directs security activities throughout the organization, such as IT, HR, marketing, legal, and other departments. The most effective CISOs find a balance between stability, efficiency, and creativity. The CISO proponent of security as a company imperative while still bearing in mind the necessity to safeguard the company from unintended damage. This role usually corresponds to top management (CFO, CEO, COO) and has direct access to the executive board.
- In managing risk, the Chief Information Security Officer (CISO) assesses risks, determines risk reduction strategies, and ensures compliance.
- In terms of value delivery, the Chief Information Security Officer (CISO) is responsible for effectively managing and maximizing the use of security assets.
- In terms of resource management, the CISO oversees creating, tracking, and evaluating recent progress and asset use.
- The Chief Information Security Officer (CISO) oversees the implementation of measures to track security operations in performance management.
- In terms of integration, the CISO responsible for establishing a connection with other assurance roles and facilitating integration on an ongoing process.
To better understand the position of the CISO, follow a hypothetical scenario through the conceptual information security governance mechanism.
- The CISO decides that an incident response plan is necessary.
- The CISO collaborates with the information security consulting committee for guidance on the proposal’s requirements.
- The information security consulting panel or the CISO appoints a task team to develop an incident response plan.
- The advisory committee assesses the document in conjunction with security service teammates.
- The CISO receives a suggestion from the information security consulting panel that the document is approved.
- The CISO evaluates and approves the document.
- Using the IT governance score sheet, the CISO decides if this ought to proceed to IT governance.
- For analysis, the CISO delivers a document to the Technology Support subcommittee.
- The Technology Support subcommittee evaluates and ratifies the document with slight modifications that the CISO approves.
- The CISO provides the Strategic IT Committee with a fully updated incident response plan for evaluation.
- The Strategic IT Committee evaluates and approves the strategy.
- The CIO advances the incident response plan to the point that it becomes a policy.
Final Thoughts
The method of organizing, guiding, monitoring, and affecting strategic decisions, activities, and behaviors is known as information security governance (ISG). Outcomes of information security governance are strategic alignment, risk management, value delivery, resource optimization, performance measurement, integration. Move towards multiple roles and responsibilities. Then discuss the Chief Information Security Officer (CISO) with an example.
About the Author
Irfan Shakeel is the founder and a lead trainer at EH Academy (training portal of ehacking.net). He teaches OSINT, penetration testing, threat intelligence, and cybersecurity leadership courses. He also writes for many publications such as AT&T Security, Infosec Institute, etc. Podcasts and webcasts hosted by Irfan can be found all over the internet.
DISCLAIMER
Views expressed in this article are personal. The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same.
