Other related standards
The guidance points to ISO/IEC 38500, the standard of guiding principles for governing bodies on the effective, efficient and acceptable use of information technology.
What clause 6.3 asks
This is a signpost, not a duty. It points the reader to ISO/IEC 38500, which sets out principles for a governing body on using information technology effectively, efficiently and acceptably, and offers guidance to the people who advise that body. The signpost sits here because the two governance domains share an audience and often a committee. The guidance does not repeat those principles or turn them into requirements. It tells a board where the technology principles live, so the board can use them for the technology estate and use the four processes in this document for the information the estate carries. Whether the signpost survives the next edition is not stated on the public record.
Why it matters
Two standards, two committees and one board is a recipe for duplication. The pointer gives a practical division of labour. The governance of IT asks whether the technology is acquired, used and disposed of in a way that serves the organization. The governance of information security asks whether the information that technology handles is adequately protected, and who answers for that judgement. A board can adopt the principles from the technology standard and still use the four processes of this guidance for security. What it should not do is let the technology committee own the security risk appetite by default, because the security risk is about the information and the organization objectives, not only about the estate.
What good looks like
Put the two governance charters side by side and mark the boundary. Name the committee that owns each, the decisions each takes and the reports each receives. Where one committee holds both, record how the security risk appetite is kept distinct from the technology investment decision. Add the ISO/IEC 38500 principles to the board induction pack with a note that they are guidance for the technology estate, not a restatement of this document. Review the boundary when the technology operating model changes.
Evidence a board or an auditor asks for
The two charters with the boundary marked; the committee terms of reference; the board induction material that distinguishes the two governance domains; the decision log that shows which body accepted which risk.
- Record The two charters with the boundary marked
- Record the committee terms of reference
- Record the board induction material that distinguishes the two governance domains
- Record the decision log that shows which body accepted which risk
Where it commonly fails
- One committee owning technology investment and security risk with no distinction recorded
- The technology standard cited as if it were this standard
- A board induction pack that mentions neither governance domain
What to do before publication
Before the edition 3 text is published, put clause 6.3 on the governance and management agenda, name the owner of each line above and give it a review date. When the final draft or the published text is available, compare it with this record and note every difference.
Read across
← 6.2 Governance activities within the scope of an ISMS6.4 Thread of governance within the organization →