Abbreviations
Only two abbreviations are defined, ISMS and IT, and the second one matters because the governance of IT and the governance of information security are not the same thing.
This clause sets the scope, the vocabulary or the structure. It is guidance, not a requirement, and it is the base every later clause builds on.
What clause 4 asks
Two short forms are listed. ISMS stands for information security management system. IT stands for information technology. The second is the one that earns its place, because the guidance treats the governance of technology and the governance of information security as related but distinct. Technology governance looks at the resources used to obtain, handle, keep and share information. Security governance looks at the protection of the information itself. Both can run through the same four processes, and the annex shows how they relate. A document that uses the two labels as if they meant the same thing will put the security question in the wrong committee and measure it with the wrong numbers.
Why it matters
Abbreviations are where documents drift. One team writes ISMS and means the certified scope, another means the whole management system, and a third means the security department. IT is worse, because the technology function often owns the budget while the security function owns the risk. Defining the two terms in a short list does not settle those disputes, but it gives the reader a place to start. The practical test is whether a new board member can read the governance pack and tell which body is accountable for the technology estate and which for the security outcome.
What good looks like
Add the abbreviations to the front of the governance pack and use them in full at first mention on every page. Where a group has a technology governance committee and a security governance forum, draw the two on one page and show the shared processes and the separate accountabilities. Do not let ISMS stand for the whole governance model; it is the management system, and the governance conversation sits above it as well as inside it.
Evidence a board or an auditor asks for
The abbreviations list in the governance pack; the one-page map of technology governance and security governance with the accountable body for each; a sample policy that uses both terms correctly at first mention.
- Record The abbreviations list in the governance pack
- Record the one-page map of technology governance and security governance with the accountable body for each
- Record a sample policy that uses both terms correctly at first mention
Where it commonly fails
- IT governance and information security governance run by the same committee with one set of measures
- ISMS used to mean the security department
- A policy that never expands either abbreviation
What to do before publication
Before the edition 3 text is published, put clause 4 on the scope and foundations agenda, name the owner of each line above and give it a review date. When the final draft or the published text is available, compare it with this record and note every difference.