Section 1: Information Security Governance
This part is about the management and governance of information security. It covers 24% of the CISM certification exam.
This section contains the following chapters:
- Chapter 1, Information Security Governance
- Chapter 2, Practical Aspects of Information Security Governance
Chapter 1: Information Security Governance
Governance is an important aspect of the certified information security manager (CISM) exam.
In this chapter, we will cover an overview of information security governance and aim to understand the impact of good governance on the effectiveness of information security projects.
You will learn about assurance functions such as governance, risk, and compliance (GRC), and details about the various roles and responsibilities of the security function. You will also be introduced to the best practices for obtaining the commitment from the senior management of an organization toward information security.
The following topics will be covered in this chapter:
- Introducing information security governance
- Understanding GRC
- Discovering the maturity model
- Getting to know the information security roles and responsibilities
- Finding out about the governance of third-party relationships
- Obtaining commitment from senior management
- Introducing the business case and the feasibility study
- Understanding information security governance metrics
Let's dive in and discuss each one of these topics in detail.
Introducing information security governance
In simple terms, governance can be defined as a set of rules to direct, monitor, and control an organization's activities. Governance can be implemented by way of policies, standards, and procedures.
The information security governance model is primarily impacted by the complexity of an organization's structure. An organization's structure includes objectives, its vision and mission, different function units, different product lines, hierarchy structure, leadership structure, and other relevant factors. A review of organizational structure will help the security manager to understand the roles and responsibilities of information security governance, as discussed in our next topic.
The responsibility of information security governance
The responsibility for information security governance primarily resides with the board of directors and senior management. Information security governance is a subset of the overall enterprise governance. The board of directors is required to make security an important part of governance by way of monitoring key aspects of security. Senior management holds the responsibility to ensure that security aspects are integrated with business processes.
The involvement of senior management and the steering committee in discussions and in the approval of security projects indicates that the management is committed to aspects relating to security. Generally, a steering committee consists of senior officials from different departments. The role of an information security steering committee is to provide oversight on the security environment of the organization.
It is very important for a CISM aspirant to understand the steps for establishing the governance, as we will discuss in the next section.
Steps for establishing the governance
For effective governance, it should be established in a structured manner. A CISM aspirant should understand the following steps for establishing governance:
- First, determine the objectives of an information security program. Most often, these objectives are derived from risk management and the acceptable level of risk that you are willing to take. One example of an objective for a bank may be that the system should always be available for customers – that is, there should be zero downtime. Information security objectives must also align with and be guided by the organization's business objectives.
- The next step is that the information security manager develops a strategy and requirements based on these objectives. The security manager is required to conduct a gap analysis and identify the strategy to move to the desired state of security from its current state of security. The desired state of security is also termed as the security objectives. This gap analysis becomes the basis for the strategy.
- The final step is to create the road map and identify specific actionable steps to achieve the security objectives. The security manager needs to consider various factors such as time limits, resource availability, the security budget, laws and regulations, and other relevant factors.
These specific actions are implemented by way of security policies, standards, and procedures.
Governance framework
The governance framework is a structure or outline that supports the implementation of the information security strategy. They provide the best practices for a structured security program. Frameworks are a flexible structure that any organization can adopt as per their environment and its requirements. Governance frameworks such as COBIT and ISO 27000 are both examples of widely accepted and implemented frameworks for security governance.
Let's look a bit closer at an example of information security governance in the next section.
The aim of information security governance
Information security governance is a subset of the overall enterprise governance of an organization. The same framework should be used for both enterprise governance and information security governance for better integration between the two.
The following are the objectives of information security governance:
- To ensure that security initiatives are aligned with the business's strategy and support organizational objectives.
- To optimize security investments and ensure the high-value delivery of business processes.
- To monitor the security processes to ensure that security objectives are achieved.
- To integrate and align the activities of all assurance functions for effective and efficient security measures.
- To ensure that residual risks are well within acceptabl...
