Security governance is the senior management buy-in, support, oversight, and monitoring to support the security objectives.
The industry-leading organisations known for their effective security practices are those with strong security governance. Their leadership places high importance on security, defines company-level objectives that support security, and sets the 'tone at the top' that cascades down across the organisation to align all employee's behavior to those objectives.
In the absence of leadership and governance, security is a topic that often falls down the list of priorities. The best outcome of effective security is to avoid negative outcomes. That makes it hard to measure and recognise the benefits. Security is also a cross-functional objective, that can't work effectively in a silo. All employees and functions play a role in information security. Formal security governance practices ensure security it is given appropriate priority, resources, and support to achieve the objectives.
Company objectives
Define and communicate objectives for the organisation, that should include security and operational objectives. These can be communicated to employees through all-hands meetings, during employee onboarding, posted on the intranet, and/or through updates sent to all employees.
Define the RACI
Who is Responsible, Accountable, Consulted and Informed (RACI) with respect to the 24 information security practices? You might have a CTO/COO as the overall responsible owner, or the accountable owner with a security or compliance analyst taking the lead. Information security is not a silo operation of the business. You’ll need formal responsibilities or at least people consulted and informed across respective functions. This includes human resources, customer support, engineering, operations, and the senior leadership team for overall governance.
Establish policy areas and responsibilities
The specific policies required for the information security requirements are covered in Part 2. At this stage, it’s about defining the functional areas and overall owners of each policy area. Polices are often perceived as a “traditional” practice no longer relevant in tech culture. Policies play an important role in empowering teams and individuals by setting out the key requirements, expectations, and boundaries that enables them to use initiative and discretion while covering the non-negotiables.
Each policy should consider:
For the CDR, the key policies to establish include; Access Control, Network Security, Acceptable Use, Change Management, Incident Management, Information Classification, and Handling, Backup, Retention, and Disposal, and the CDR Policy.
Governance Meetings
Governance meetings perform the function of oversight, monitoring, and general management of the information security function (among other functions). This can include approving outputs of the security and compliance activities like the risk and control assessments, penetration tests, third-party audits, monitoring key performance and risk indicators, and generally supporting the objectives through a high-level involvement.
These governance meetings can include the Board of Directors, Senior Leadership Team, a Security, Risk, and Compliance (SRC) Committee, Team Management Meetings, and company-wide or all-hands meetings. We’ve covered this topic in more depth in our Best Practices - Governance post.
Organisational security posture
There are two key areas that are from the 24 information security practices, that play an important role in the information security capability. The Acceptable Use Policy and Security and Privacy Awareness Training. These play an important role in supporting general awareness and a company-wide approach to information security. Most security breaches have a human element so these practices are incredibly important.
Security expertise
Although it’s no longer a must-have to have security experts in-house, organisations that are well supported by security experts are in a better position to prepare for and respond to security events. The modern approach to this can involve a good relationship with your penetration test provider, using security consultants to support, or the modern CISO-as-a-service model that has security experts on retainer to call on as needed.
Business Planning
Business planning is a ubiquitous practice that varies a lot in the way it’s conducted. The purpose in this context is to ensure the business strategy, operational resources, and objectives fit together and support each other. For the CDR specifically, it may be setting the target date for accreditation, arranging the necessary people and time commitments, and planning the steps and activities necessary. In most of the projects we support like this, there’s a tipping point reached that recognises the priority needs to be higher, resources increased, or other intervention actions to really get it moving. Prior to that, it falls behind other competing priorities.
If you're wondering what this looks like "on paper" - get in touch with our team <info@assurancelab.com.au>. We're happy to share examples and guide you through how this may look for your business.
The CDR Perspective
The CDR Schedule 2, Part 1 requires the following in relation to defining and implementing security governance in relation to CDR data:
About AssuranceLab
AssuranceLab is a modern cybersecurity audit firm that provides assurance reports (ASAE 3150, SOC 1/2). We're experts in the latest software and cloud providers. We guide your team through the compliance practices in a way that fits your environment and culture. We work closely with clients through our agile and collaborative approach; saving time, costs, and headaches along the way.