Estimated Reading Time: 3 Minutes
Written by: Aaron Nolan
Although they sound similar, Information Security Governance and Information Security Management operate at completely different levels of the business – one at board level and the other at management level. Throughout this blog, we will explore the differences between these functions and explain how they complement each other within the business’s security strategy.

Information Security Governance

Information Security Governance is a framework or standard set out by the board members, directors or partners of an organisation. This system outlines the security goals of the company, establishing how they will operate. In any mature business, the board members, directors or partners of an organisation are solely accountable for the Security Governance. It should be viewed as a non-negotiable business requirement that comes from the top down.

One of the first things a company should do is outline its Organisational Policy Statement, which is also referred to as the master security policy. This statement describes the strategic functions of the organisation and enacts company policy, and it should come across as an essential part of the business’ long-term strategic plan.

Essentially an Organisational Policy should protect a company’s finances, reputation and assets; so it must detail how the business and its assets should be governed. Thus allowing the organisation to allocate resources based upon their risk.

A key benefit of having a Governance Framework or standard in place is that it ensures goals are in place which can be measured against current performance. It provides shareholders with oversight and reassures them that risk is being adequately mitigated. Our latest article highlights the characteristics and many benefits of adhering to frameworks, guidelines and standards. Click here to read it and discover which we recommend.

Information Security Governance should not only align the framework against the company’s strategic objectives but also ensure that it complies with local and international regulatory laws. Overall, it is an essential part of a business’ risk management strategy, and it will have a direct impact on the course that the company will take over the long term.

Information Security Management

Information Security Management aligns the organisation’s functions to its strategic objectives. It is the practical enforcement of the policies and practices defined by the Information Security Governance structure. The organisation’s senior management is responsible for implementing these controls and ensuring that they are being adhered to on a daily basis. Therefore, the Security Governance authorises the Security management to make decisions on the company’s behalf.

Information Security Management also alludes to the management of vulnerabilities and potential threats posed to the organisation. As such, it is the responsibility of senior management to manage risk on behalf of the organisation. This also implies that any risk not detected by C-level management may not be effectively addressed by Information Security Management. They are responsible for managing risk, but not accountable.

Senior management is also expected to oversee project management to ensure that the strategy set out by the Governance structure is worked towards. Senior management would have full utilisation of the allocated budget to develop projects to reach the framework or standards set by the Security Governance.

In Conclusion

Information Security Governance is crucial for any business as it not only allows for budgeting for both capacity and new technologies but it also helps prepare for times of disaster. Negligence in the area of Information Security Governance can result in board members, directors or partners being held responsible for breaches, damage to company reputation or even financial loss.

Information Security Governance helps to outline goals, standards or frameworks for an organisation to achieve. Indeed without any of these things, an organisation’s procedures can never be defined.

Security Governance is a “buy-in” from the top level of the company, and it is necessary for the Information Security Management to work within a company.