Thread of governance within the organization
Four threads run through the governance model: alignment, risk management, conflicts of interest, and preventing the organization technology from harming others.
What clause 6.4 asks
Four threads run through the model, and they line up with the four processes. The first is fit between security objectives and business objectives. The second is handling security risk in a way that follows those objectives. The third is keeping conflicts of interest out of security management. The fourth is stopping the organization's technology from being used to injure other organizations. The last two apply general governance concerns to security. No fifth process is added. Instead the clause says what should be visible each time the cycle turns, whether the cycle covers the whole entity or a single management system.
Why it matters
The threads are the test of whether the cycle is real. Alignment shows in a strategy that names the business objectives and the security objectives that serve them. Risk management shows in a register that the entity risk function recognises and in an appetite that the board has set. Conflict of interest shows in who sets policy and who executes it, and in the arrangements around security roles that also hold buying or audit power. The fourth thread is the one most often missed. Security teams spend their time stopping attacks from outside, and rarely ask whether systems or staff inside the organization could be used to damage a customer, a supplier or another organization. A governance record that covers the first three and ignores the fourth is incomplete.
What good looks like
Take each thread and write down the artefact that shows it, the owner and the review date. For alignment, attach the strategy map. For risk, attach the appetite statement and the register extract. For conflict of interest, attach the register and the role separation note. For the fourth thread, attach the acceptable use policy, the customer impact assessment and the incident route that would catch misuse. Review the four together at the same meeting so that one does not drift while the others are maintained.
Evidence a board or an auditor asks for
The four-thread evidence set; the strategy map; the appetite statement; the conflict of interest register and role separation note; the acceptable use policy and the misuse scenario in the incident plan.
- Record The four-thread evidence set
- Record the strategy map
- Record the appetite statement
- Record the conflict of interest register and role separation note
- Record the acceptable use policy and the misuse scenario in the incident plan
Where it commonly fails
- Security objectives written with no reference to a business objective
- One person setting security policy and executing it with no separation recorded
- No consideration of the organization systems being used to harm another party
What to do before publication
Before the edition 3 text is published, put clause 6.4 on the governance and management agenda, name the owner of each line above and give it a review date. When the final draft or the published text is available, compare it with this record and note every difference.
Read across
- 6.1 Overview: governance and management of information security
- 7.2.1 Objective 1: Establish integrated, comprehensive, entity-wide information security
- 7.2.2 Objective 2: Make decisions using a risk-based approach
- 7.3.2 Evaluate
- 7.3.3 Direct