One page per clause
The duty in our words, the evidence a board or an auditor asks for, the common gaps and what to do before publication.
Open the registerWhat is information security governance?
It is the means by which the governing body gives overall direction and control to the activities that affect the security of the organization information. It sets strategy and policy, monitors performance and evaluates proposals, while management delivers the objectives and reports on them. It is not the same as managing security, and it is not the same as governing technology.
Last updated: . Written from the published edition and the ISO record. Not legal advice; does not certify.
Direction and control
The governing body sets the direction through strategy and policy, monitors the organization performance and evaluates the proposals and plans that managers bring. Control is the ability to change direction when the evidence says the current path will not reach the objectives. Both halves matter. A board that only approves documents has direction without control.
The four processes
Evaluate, direct, monitor and communicate. Evaluate looks at current and forecast achievement and decides what to adjust. Direct sets strategy, appetite, resources and roles. Monitor receives the effectiveness report and sends priorities back. Communicate exchanges information with interested parties and explains incidents. The processes run continuously, not once a year.
What it is not
It is not the technology governance committee, although the two can share a cycle. It is not the security operations function, although it depends on the reports that function produces. It is not a certificate, and it is not a maturity score.
How to tell whether it is working
Ask for the last four board agendas and mark the direction, performance and decision items. If a line has no entry, that part of the cycle is not running. Then ask who accepted the largest residual risk and when. If the answer is below the board, direction has been delegated.
Related clauses
- 5 Use and structure
- 6.1 Overview: governance and management of information security
- 7.3.2 Evaluate
- 7.3.5 Communicate
Questions
Is governance the same as management?
No. Governance sets direction and control. Management achieves the objectives the direction sets, and reports on them.
Who owns it?
The governing body is accountable. Top management runs the management system and reports upward. The CISO usually prepares the record but does not own the accountability.
Does it need a committee?
Not necessarily. It needs a recurring slot where the four processes happen, with inputs and records. A committee is one way to provide that, not the only one.
Run the free check / Open the register / The kit and the watch
THE RULES THIS IS BUILT FROM
Read from the real rules, not invented
Every clause answer on this site points to the official rule behind it, so you can check any line yourself. The register holds 28 records, 110 evidence lines and 84 common failure lines. The dates come from the ISO record. The substance comes from the published 2020 edition, which is the baseline that edition 3 replaces.
25 CLAUSES
3 ANNEXES
Guidance, clearly labelled
Annexes A to C are informative. Each page says so, because a finding cannot rest on guidance alone.
Open the annexesONE STAGE RECORD
No invented date
Stage 50.60 is recorded on 12 August 2026. The planning date is an estimate and is labelled wherever it appears.
Read the recordThe edition 3 text is not public and is not reproduced. Each record cites the published clause it comes from. Where the public record is silent, the page says so.