Security Governance
Security governance is the set of decision rights, accountability structures and oversight mechanisms that determine how an organisation directs and controls information security. The CPIT InfoSec exam tests whether you can separate governance (who decides, who is accountable, how performance is reported) from management (how controls are built and run day to day), and whether you can trace a framework requirement to the artefact an auditor would actually ask for.
Governance bodies and accountability
- The board retains ultimate accountability for risk appetite and delegates oversight to a security steering committee with business, IT, legal and risk representation.
- A CISO usually owns the security programme but not all risk: business process owners accept residual risk inside their own functions.
- Three lines model: operations own and manage risk, security and compliance monitor and advise, internal audit gives independent assurance to the board.
Core artefacts
- Information security policy: short, board-approved, states intent and mandatory requirements. It is supported by standards (prescriptive, technology-specific), procedures (step-by-step) and guidelines (advisory).
- Risk appetite and tolerance statements translate business objectives into measurable thresholds.
- Reporting uses KPIs (control coverage, patch latency) and KRIs (open critical findings, repeat incidents) to show whether controls actually work.
Worked example
A retailer's board asks whether the security programme is effective. The right answer is not a tool list. Governance evidence chains intent to outcome: the approved policy requires payment data to be encrypted; a standard names the algorithm, mode and key length; the KRI dashboard reports the percentage of cardholder-data stores that comply; internal audit samples 20 stores and finds 18 compliant. The two gaps produce a corrective action plan with a named owner and due date, reported back to the steering committee. That chain of policy, standard, metric, independent assurance and remediation is what exam questions reward, because each link is auditable.
Traps that cost marks
- Confusing the CISO with the risk owner: accountability for accepting a business risk stays with the business unit.
- Treating policies as technical documents; policy states management intent, standards carry the technical detail.
- Assuming internal audit reports to the CISO, which destroys the independence that makes it useful.
- Writing governance answers as control lists with no owner, metric or review cycle.