Information security governance and strategy
What the domain tests
This domain tests governance as direction and control, not day-to-day security operations. Questions probe how a governing body sets information security direction, how strategy follows organizational strategy and risk appetite, and how assurance and reporting work inside the ITIL 4 service value system.
Core rules
- Governance is the means by which an organization is directed and controlled. The governing body is accountable for information security, even when it delegates delivery.
- Information security governance sets direction, approves policy, defines risk appetite, assigns accountability and provides assurance. Management executes within that direction.
- The security strategy translates organizational objectives and obligations into principles, target posture, investment priorities and measurable outcomes.
- Policies, standards and procedures are governance instruments. Roles such as accountable executive, security manager and control owner should be explicit.
- Governance connects to the SVS through the governance component, the plan activity and continual improvement reporting. Escalation paths and performance measures make it real.
- Compliance is evidence of meeting obligations, not proof that risk is acceptable.
Worked example
A board sets low tolerance for customer data exposure. Governance translates that appetite into policy: data classification, MFA for privileged access, supplier security clauses and a quarterly assurance report. The plan activity receives the direction, engage communicates it, and improve uses the metrics. Reasoning: strategy and policy must flow from appetite; if the security team buys tools without that direction, investment cannot be traced to risk appetite.
Traps that cost marks
- Treating governance as the security team's operational job.
- Writing a strategy as a tool list with no outcomes or appetite.
- Equating compliance with security.
- Leaving accountability at manager level with no executive owner.
- Having no escalation route or assurance reporting cycle.