Cybersecurity governance is the set of policies, processes, roles, decision rights, and oversight used to direct a security program. It establishes who can make decisions, who is accountable, and how security work supports organizational goals, protects assets, manages risk, and meets legal obligations. section 5.1
Governance gives risk management its objectives and scope and guides policy approval. Risk assessments then inform policy changes. This relationship works best when security leaders understand the organization’s mission, the board’s expectations, and its appetite for risk. section 5.1 section 5.2
Make the structure usable by specifying:
- Authority and reporting: identify decision-makers, accountability, and communication paths, including how the CISO reaches executive leadership and the board. section 5.6.1 section 5.6.2
- Resourced responsibilities: distinguish IT from cybersecurity duties and document ownership of incident response, access controls, compliance, and certifications. section 5.4
- Follow-through: assign owners and due dates to cybersecurity board actions, then track open, closed, and overdue items in a plan of action or risk register. section 5.4.1
A board investment decision
Suppose compliance concerns are driving spending while proactive threat intelligence receives little attention. Rather than report only how many phishing attempts were blocked, security leaders can describe the potential financial effect of a successful attack and the return on security training. The board can then weigh investments against business risks and risk appetite. section 5.2
Measure governance where the result helps someone act. The share of board actions closed on time can expose a need for resources or a revised plan; counting documented roles may show implementation progress. Avoid collecting metrics whose maintenance costs outweigh their value. Review indicators with senior management and the board to check that security remains aligned with strategy. section 5.4.1 section 5.6
Figure 5.9 The governance structure of our example company, Acme Tech
The simulated company structure provides a concrete way to inspect reporting lines and accountability among the board, CISO, and cybersecurity staff. section 5.6.2
