Overview: governance and management of information security
Governance sets direction and control from the top; management achieves the objectives that direction sets. Effective security needs both roles played consistently.
What clause 6.1 asks
Governance of information security is how the governing body gives overall direction and control to the activities that affect the security of the information the organization holds. It concentrates on the situations where weak security would damage the ability of the organization to reach its objectives. A governing body usually does this by setting direction through strategy and policy, by monitoring performance, and by evaluating the proposals and plans that managers bring. Management of information security delivers the objectives in those strategies and policies. It works with the governing body by bringing proposals and plans for consideration and by reporting performance. Governance works when the members of the governing body and the managers each play their part consistently, and it frays when one side does the other job.
Why it matters
The distinction is not decorative. A board that approves a policy and then never sees a performance report is governing on paper. A management team that decides its own risk appetite has taken a decision that belongs above it. The clause gives each side a job description in a paragraph: direction, monitoring and evaluation on one side; proposals, delivery and reporting on the other. The word consistently matters, because the failure is usually intermittent. The board engages after an incident and then drifts back to a yearly approval. The record should show a rhythm, not a burst.
What good looks like
Write the two job descriptions into the governance terms of reference. For the governing body: the direction it sets, the performance it receives, the proposals it evaluates and the decisions only it can take. For management: what it proposes, what it delivers and what it reports. Then check the last four board agendas against the list. If a line has no entry, the role is not being played. Fix the agenda before writing another policy.
Evidence a board or an auditor asks for
The governance and management terms of reference; the last four board agendas with the direction, performance and decision items marked; the management reporting pack and the proposals it contains.
- Record The governance and management terms of reference
- Record the last four board agendas with the direction, performance and decision items marked
- Record the management reporting pack and the proposals it contains
Where it commonly fails
- A board that approves policy and never receives a performance report
- Risk appetite decided by the security function alone
- A reporting pack that describes activity but not achievement of objectives
What to do before publication
Before the edition 3 text is published, put clause 6.1 on the governance and management agenda, name the owner of each line above and give it a review date. When the final draft or the published text is available, compare it with this record and note every difference.
Read across
← 5 Use and structure6.2 Governance activities within the scope of an ISMS →