Governance versus management
ISO/IEC 27014 draws a useful line. Management runs information security day to day. Governance sits above it: the governing body evaluates the current and future position, directs through strategy and policy, monitors performance, and communicates with stakeholders. A governance model makes those activities concrete — who decides what, in which forum, on what evidence.
Six principles for a governance model that works
- Every requirement is stated once. Regulations, contracts and standards overlap heavily. Consolidate them into one requirements baseline so that each obligation is traced, owned and evidenced once.
- Every decision has a home. Each type of decision — risk acceptance, policy approval, exceptions, investment — is assigned to one governance body or role.
- Every interaction names the document that governs it. Escalations, reports and approvals point to the charter, policy or procedure that sets them.
- One accountable party. A RACI with more than one "A" per activity is not a RACI.
- Status is evidenced, not asserted. Board reports are built from measures, and each measure traces back to a procedure.
- Maintain the model. Governance documents are living; review cycles are part of the design.
The building blocks
Context and drivers. Start with the governance drivers — regulation, contractual commitments, board expectations — and the inputs from the security strategy and operating model. Decide the governance scope and archetype: centralised, federated or hybrid.
Assessment. Measure conformance with ISO/IEC 27014 and governance maturity, and build the consolidated requirements baseline. Check coverage: which requirements have no owner, no policy and no evidence?
Structure and decision rights. Define the governance bodies — typically a board-level risk committee, an executive security steering group and operational forums — each with a charter covering purpose, membership, quorum, decision rights, inputs and outputs. Document delegation of authority explicitly.
Responsibilities and interactions. Build a RACI across the governance processes and draw interaction maps showing how information and decisions flow between bodies, the security function, risk, audit and the business.
Policies and procedures. Structure the document hierarchy — policy, standards, procedures — so that each requirement in the baseline lands in exactly one place.
Performance management. Define tiered measures: strategic indicators for the board, management KPIs for the executive forum and operational metrics for the teams, each with an owner, a source, a target and a reporting cycle.
A quick test of your current governance
Pick a recent risk acceptance decision and try to answer: who made it, under what authority, on what evidence, and where is it recorded? If any answer takes more than a few minutes to find, the governance model has a gap.