Security and Privacy Governance, Risk Management, and Compliance
Governance sets the rules, the roles, and the accountability
Security and privacy governance answers three questions: what must we do (laws, regulations, contracts, mission needs), who is accountable, and how do we know it works. Place NIST SP 800-39's three tiers - organization, mission/business process, information system - and the owners at each. The Authorizing Official (AO) accepts risk on behalf of the organization. The system owner is accountable for the system and its security plan. The ISSO supports operation and documentation. The risk executive function aggregates and normalizes risk across the portfolio. Privacy is not a subset of confidentiality: it has separate legal drivers, a separate assessment instrument (PIA/DPIA), and a separate accountability chain, usually a senior official for privacy.
Traps
The classic trap is confusing accountability with activity. Many people "do" risk management, but only the AO accepts risk; an option saying the ISSO accepts residual risk is wrong. A second trap merges compliance with security: passing an audit does not mean risk is acceptable, and a written policy is not evidence of implementation. A third is treating privacy as optional once PII appears; the first step is normally a privacy threshold analysis, not a confidentiality control.
Worked example
A question asks who approves a system's security plan when the system processes PII. Reasoning: the plan is a system-level document owned by the system owner, but its approval and the associated risk acceptance belong to the AO, with privacy input from the privacy official. Answer: the AO - not the ISSO and not the assessor.