thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Foundational

Information Security Governance

The leadership, structures, and processes that ensure security strategy supports business objectives and manages risk to an acceptable level.

Definition

Information security governance is a subset of corporate governance in which the board and executive management set direction, assign accountability, approve risk appetite, and monitor security performance. Its outcomes include strategic alignment, risk management, value delivery, resource management, performance measurement, and assurance integration. Responsibility for governance ultimately rests with the board of directors and senior management.

Example

The board approves a security strategy and receives quarterly metrics on progress against it.

Exam tip

On CISM, the board and senior management are accountable for security governance; the CISO advises and executes.

Related terms