Information Security Governance
Governance sets direction; management executes it
Information security governance is the structure through which senior leadership directs, oversees and remains accountable for security. Know these building blocks: a security strategy explicitly aligned with business objectives; a governance body (board committee or a security steering council with business representation) and a clearly placed CISO with a defined reporting line; the policy hierarchy, where policy states management intent, standards set mandatory requirements, procedures describe the steps and guidelines advise; performance measurement through KPIs and maturity assessments; and assurance, meaning independent audit and review kept separate from the teams operating the controls.
Traps candidates fall into
Questions at this level rarely reward a technical answer. When the stem describes board-level concern about value or budget, the strongest option usually addresses business alignment, reporting or accountability rather than a new tool or scan. Separate the security manager's role (advise, propose, measure) from the business owner's role (decide, fund, accept risk): any choice that has security "approving" business activity instead of enabling an informed decision is usually wrong. Also check whether a policy already exists - if it does, the issue is enforcement, awareness or monitoring, not drafting.
Worked example
A board asks why security spending keeps rising without visible benefit. Weak answers: run a penetration test, buy another product, cut the budget. Strong answer: define metrics that express security performance in business terms - time to remediate critical findings, coverage of critical assets by monitoring - and report them through the governance channel so investment decisions rest on evidence.
Rule of thumb: if the question asks who decides, the answer is a business owner or governing body; if it asks who advises or measures, it is security management.