IT Governance, Policy, and Compliance
IT Governance, Policy, and Compliance tests who decides, what rules apply, how risk is accepted, and how evidence proves compliance.
Core rules
- Governance sets direction and accountability; management executes. Policies state mandatory intent, standards specify requirements, procedures give steps, and guidelines are advice.
- COBIT supports IT governance; ISO/IEC 27001 defines an information security management system; the NIST Cybersecurity Framework organizes risk functions.
- A risk register records likelihood, impact, owner, treatment, and residual risk. Risk acceptance must be authorized.
- Segregation of duties prevents one person from requesting, approving, and auditing the same transaction.
- Retention and privacy rules depend on data classification, legal holds, and jurisdiction. Auditors need independence and evidence.
- Exceptions need scope, expiry, compensating controls, and approval.
Worked example
A team wants a shared admin account for a critical server. The policy requires unique accounts. The request is an exception, not a standard. Document the business need, require manager and security approval, set an expiry date, add compensating controls such as vaulting, session recording, and rotation, and log use. Without approval and expiry, it is a policy violation.
Traps
Do not call a procedure a policy. Do not treat compliance as proof of security. Do not let the person who approves a change also audit it. Do not accept risk informally by email without a register entry. Do not retain data indefinitely just in case.