Information Security Governance and Strategy
What this domain tests
Information security governance and strategy examines who decides, who is accountable, and how security work is directed toward business objectives. Questions probe board and executive responsibility, governance bodies, strategy development, performance reporting, and the difference between governance and management.
Core rules
- Governance sets direction, risk appetite, and oversight; management executes day-to-day controls.
- ISO/IEC 27001 clause 5 assigns top-management leadership, policy approval, and role assignment; clause 9 requires monitoring, internal audit, and management review.
- A steering committee should include business, risk, legal, and security representation, with documented decisions and escalation paths.
- Strategy translates business goals and legal obligations into a roadmap, measurable objectives, and funding decisions.
- Metrics must be decision-useful: risk exposure, control coverage, incident trends, and remediation aging, not raw alert counts.
Worked example
A retailer's board is asked to fund endpoint detection and response. The CISO presents the risk register: ransomware is the top scenario, payment systems are high-criticality, and current detection coverage is 40%. The governance committee compares the proposed spend with risk appetite, asks legal about breach-notification exposure, and approves a phased rollout. It sets a quarterly metric: percentage of high-criticality endpoints covered. The decision is minuted, and management reports progress. Reasoning: the board does not choose a product; it sets risk tolerance, prioritizes, and holds management accountable.
Traps
- Treating governance as an IT operations meeting.
- Approving a strategy with no measurable outcomes or owner.
- Confusing a policy statement with a strategy.
- Reporting activity metrics that do not show risk reduction.