Chapter 11 — Security governance foundations

Chapter 11 — Security governance foundations

Lesson map

Lesson 11 published. Map, example, EX031.

flowchart TD
  N0["Learning outcomes"]
  N1["11.1 What governance means"]
  N2["11.2 The board's role"]
  N3["11.3 Frameworks"]
  N4["11.4 Risk appetite"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX031"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["11.1 What governance means"]
  N2["11.2 The board's role"]
  N3["11.3 Frameworks"]
  N4["11.4 Risk appetite"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX031"]

[Learning outcomes]
    |
    v
[11.1 What governance means]
    |
    v
[11.2 The board's role]
    |
    v
[11.3 Frameworks]
    |
    v
[11.4 Risk appetite]
    |
    v
[Worked example] --> [Exercise EX031]

Learning outcomes

You will (1) explain what security governance is; (2) describe how boards oversee security; (3) relate governance to frameworks.

11.1 What governance means

In her second year, Aisha studies security governance: how an organisation directs and oversees its security. Governance answers who decides how much risk is acceptable, who is accountable and how leaders know whether security is working. Dr. Carrow distinguishes governance from management. The board sets direction and asks questions; managers design and run controls. Aisha notes that at Ashfield the board approves the risk appetite and receives quarterly security reports, while the IT manager runs day-to-day controls and reports progress upward. She draws both.

11.2 The board's role

Ashfield's board includes volunteers elected by members, few of whom have technical backgrounds. Aisha considers what they need: a clear picture of the main risks, whether controls are working and what decisions require their approval. She reviews a synthetic board report filled with technical counts and suggests replacing it with five risk statements, each with a trend and an owner. Dr. Carrow notes that good governance depends on information leaders can understand and act on, not on volume. The board chair welcomes the change.

11.3 Frameworks

Aisha studies the NIST Cybersecurity Framework 2.0, which added a Govern function to Identify, Protect, Detect, Respond and Recover. The Govern function covers organisational context, risk management strategy, roles, policy and oversight. She maps Ashfield's current arrangements to these outcomes and finds that roles and policy exist but supply chain risk management is weak. Dr. Carrow explains that frameworks help organisations see gaps systematically, but that they describe outcomes rather than prescribing exact methods. She presents the mapping as a table with one row per outcome and a simple status for each.

11.4 Risk appetite

A risk appetite statement says how much risk an organisation will accept in pursuit of its goals. Ashfield's board states it will accept low risk to member data confidentiality but moderate risk of short service interruptions outside business hours. Aisha notes that this guides decisions: spending to prevent data exposure is justified more readily than spending to eliminate brief overnight outages. She learns that appetite statements turn vague values into practical guidance managers can apply. Aisha uses the statement to explain two past spending decisions to her seminar group.

Worked example

Aisha separates governance from management, simplifies the board report into five risk statements, maps Ashfield to CSF 2.0 Govern outcomes and applies the risk appetite to spending.

Synthetic case. Board arrangements are synthetic.

Errors and limits

Board reports full of technical counts rarely support decisions.

Exercises

• EX031 — Board approves. What does Ashfield's board approve? Rubric: 3 = the risk appetite;; 2 = partly correct;; 1 = other;; 0 = none.
• EX032 — Govern gap. Which Govern outcome is weak at Ashfield? Rubric: 3 = supply chain risk management;; 2 = partly correct;; 1 = other;; 0 = none.
• EX033 — Appetite effect. Which spending is justified more readily? Rubric: 3 = preventing data exposure;; 2 = partly correct;; 1 = vague;; 0 = none.

Continue studying — lesson 11 (chapter 11 of 40)

← Chapter 10 · Course chapter index · Chapter 12 →

Continue to the next authored lesson.