CSG: Security Governance

Security governance is the system of direction, accountability, and oversight that keeps an information security programme aligned with business objectives. The CSG exam tests whether you can separate governance from management, attach accountability to the right role, and explain how strategy, risk appetite, and performance reporting fit together.

What governance actually decides

• Governance sets direction - strategy, risk appetite, roles, funding, and priorities. Management executes within that direction. A frequent exam distinction is that governance decides what risk is acceptable; management decides how it is treated.
• Ultimate accountability sits with the board and senior leadership and is not delegated. ISO/IEC 27001:2022 clause 5 requires top management to establish the security policy, assign roles and responsibilities, and integrate security into business processes. Clause 9 requires performance evaluation and management review with defined inputs and outputs.
• The three lines model separates duties: the first line (business and IT operations) owns and manages risk; the second line (security, risk, compliance) provides frameworks, oversight, and challenge; the third line (internal audit) gives independent assurance and reports to the board or audit committee. External audit sits outside all three.
• A security steering committee prioritises and funds remediation. The CISO usually owns the programme and advises on risk, but the business process owner accepts the risk.

Turning governance into evidence

• Governance artefacts include the security charter, strategy, risk appetite statement, RACI matrix, committee minutes, management review records, and metric reports.
• KPIs measure activity, such as percentage of patches applied within SLA. KRIs measure exposure, such as count of critical vulnerabilities open longer than 30 days. Board reporting should show KRI trends, not only incident counts.
• Due care means the right programme exists; due diligence means verifying that it operates through testing, audit, and metrics. Regulators and courts examine both.

Worked example

A bank plans to move a core system to a public cloud. The governance question is not "is the cloud secure" but "who decides, against what appetite, on what evidence". The business owner submits a risk assessment; the second line checks the residual risk against the approved appetite statement; the steering committee approves with conditions - an exit plan, data residency controls, and an annual review - and minutes the rationale. A KRI tracks control drift. The CISO advises but does not accept the risk on the bank's behalf.

Traps that cost marks

• Assuming the CISO owns all risk. Ownership follows the business process, not the security team.
• Treating governance as documentation. Assessors look for decisions, minutes, and follow-through.
• Equating compliance with governance: passing an audit does not prove risk is managed.
• Omitting management review, which ISO/IEC 27001 clause 9.3 treats as a required, evidenced activity.