Direct
Direct is where the governing body sets strategy, risk appetite and resourcing, and top management allocates the investment, roles and policy that deliver it.
What clause 7.3.3 asks
Direction has two levels. The board sets the entity's aims and strategy, changes resourcing, ranks activities, approves policies, accepts material risk and approves risk plans. It also states how much and what kind of risk the entity will pursue or keep, and approves the security strategy. Leadership in each management system then provides investment and people, aligns security objectives with the entity's, assigns roles and establishes the security policy. The pair matters. Approval without funding is a wish, and a strategy that never reaches the resource decision has not been directed. Material risk acceptance is the sharpest test: if the largest risks are accepted below the board, the board has given away the judgement that most needs it.
Why it matters
Direction without resources is a wish. The clause pairs the board approval of strategy and appetite with the management allocation of investment, roles and policy, which is where most directions are quietly reversed. A strategy that is approved but not funded has not been directed. The clause also places material risk acceptance with the governing body, which is the sharpest test of whether direction is real. If the largest risks are accepted below the board, the board has delegated the decision that most needs its judgement. The split between the two levels is not about status. It is about who has the authority to commit the entity and who has the knowledge to make the commitment work.
What good looks like
Write the direction in a form the organization can act on: the strategy, the appetite, the resource envelope, the roles and the policy. Record the board approval of the strategy and the appetite, and the management decision on resources and roles, with dates. Bring every material risk acceptance to the board with the treatment plan and the residual position. Check that the policy in force is the one the board approved, not a later revision that never went back. Review the resource envelope when the strategy changes.
Evidence a board or an auditor asks for
The approved strategy and appetite statement; the resource decision and the roles assigned; the information security policy with its approval record; the material risk acceptance log with the board decision.
- Record The approved strategy and appetite statement
- Record the resource decision and the roles assigned
- Record the information security policy with its approval record
- Record the material risk acceptance log with the board decision
Where it commonly fails
- A security strategy never put to the governing body
- Material risk accepted at management level
- A policy revised after approval without a new approval
What to do before publication
Before the edition 3 text is published, put clause 7.3.3 on the entity governance and the objectives agenda, name the owner of each line above and give it a review date. When the final draft or the published text is available, compare it with this record and note every difference.
Read across
- 7.2.2 Objective 2: Make decisions using a risk-based approach
- 7.2.6 Objective 6: Ensure the security performance meets current and future requirements of the entity
- 7.3.2 Evaluate
- 7.3.4 Monitor