Information Security Governance

To establish and maintain a framework that provides assurance that security strategies align with and support business objectives, are consistent with applicable laws and regulations, and that risk is managed appropriately.

The board of directors and senior management hold ultimate accountability; governance is a board and executive responsibility, though execution is delegated.

Strategic alignment, risk management, value delivery, resource management, performance measurement, and integration (assurance process integration).

Governance sets direction, establishes objectives, and monitors performance (the board's role); management plans, builds, runs, and monitors activities to achieve those objectives (the executive role).

It means aligning information security activities and investments with enterprise business objectives so that security enables rather than hinders the achievement of organizational goals.

Value delivery means optimizing security investments so they support organizational objectives, delivering the right level of protection at acceptable cost without over- or under-investing.