"02 Security Governance"

Security governance defines how an organization directs, manages, oversees, and holds people accountable for cybersecurity.

It ensures that security is not treated as only a technical responsibility of the IT or cybersecurity team. Instead, cybersecurity becomes part of enterprise leadership, business strategy, risk management, compliance, and organizational decision-making.

A mature security governance program answers questions such as:

Who is accountable for cybersecurity?
Who approves security policies?
Who owns security risks?
Who can accept risk?
How are security priorities aligned with business objectives?
How does leadership receive visibility into cybersecurity risk?
How are security responsibilities distributed across the organization?
How are exceptions and policy violations handled?

By the end of this lesson, you should understand how enterprise security governance operates and how GRC professionals support leadership, accountability, policy management, risk oversight, and decision-making.

Learning Objectives

By the end of this lesson, you will be able to:

Explain the purpose of security governance.
Understand the relationship between business governance and cybersecurity.
Identify key governance stakeholders.
Understand roles and responsibilities across the organization.
Explain the role of the Board, executive leadership, CISO, risk teams, and control owners.
Understand security policy governance.
Explain risk ownership and risk acceptance.
Understand security committees and governance forums.
Understand governance metrics and reporting.
Recognize common security governance weaknesses.
Understand how GRC professionals support governance activities.

1. What Is Security Governance?

Security governance is the system through which an organization:

Establishes cybersecurity direction.
Defines security responsibilities.
Creates policies and standards.
Assigns accountability.
Oversees security risk.
Monitors performance.
Makes risk-based decisions.
Ensures cybersecurity supports business objectives.

A simple model is:

Business Strategy
       │
       ▼
Executive Leadership
       │
       ▼
Security Governance
       │
       ├── Policies
       ├── Roles
       ├── Risk Decisions
       ├── Security Strategy
       ├── Oversight
       └── Reporting
       │
       ▼
Security Operations

Governance provides the direction.

Security teams then implement the required controls.

2. Governance vs Management

Governance and management are related, but they are not identical.

Governance

Governance determines:

What the organization wants to achieve.
What level of risk is acceptable.
Who is accountable.
What policies must be followed.
How performance will be monitored.

Management

Management determines:

How objectives will be achieved.
How teams will operate.
How controls will be implemented.
How resources will be allocated.

A simple distinction is:

Governance
→ Sets direction

Management
→ Executes direction

For example:

Governance Decision:
All privileged accounts must use MFA.

Management Action:
IAM team configures MFA across systems.

3. Why Security Governance Matters

Without effective governance, cybersecurity programs often become reactive.

Different teams may implement controls independently without understanding business priorities.

This can result in:

Unclear responsibilities.
Duplicate security tools.
Inconsistent policies.
Unmanaged risks.
Security exceptions without approval.
Poor executive visibility.
Regulatory findings.
Weak accountability.
Security investments that do not support business priorities.

Governance creates structure.

Business Objectives
       │
       ▼
Security Strategy
       │
       ▼
Risk Priorities
       │
       ▼
Policies & Controls
       │
       ▼
Security Operations
       │
       ▼
Monitoring & Reporting

4. Security Governance Principles

Strong security governance normally includes several core principles.

Accountability

Someone must be responsible for every important security activity.

Transparency

Leadership should understand major risks, issues, and security performance.

Alignment

Cybersecurity should support business strategy.

Risk-Based Decision Making

Security investment should focus on meaningful business risks.

Defined Authority

People must understand who can approve policies, accept risks, or authorize exceptions.

Continuous Oversight

Security governance should operate continuously rather than only during audits.

5. Enterprise Governance Structure

Security governance normally involves multiple layers of the organization.

Board of Directors
        │
        ▼
Executive Leadership
        │
        ▼
CEO / CIO / CISO / CRO
        │
        ▼
Security & Risk Committees
        │
        ▼
GRC / Security Leadership
        │
        ▼
Control Owners
        │
        ▼
Operational Teams

Each layer has different responsibilities.

6. Board of Directors

The Board of Directors provides high-level oversight.

The Board does not normally configure security technologies.

Instead, it focuses on questions such as:

What are the organization’s major cyber risks?
Is management addressing those risks?
Are appropriate resources being allocated?
Are significant security incidents being managed properly?
Does cybersecurity risk threaten business strategy?
Are legal and regulatory obligations being fulfilled?

Board-level reporting should therefore focus on business impact, not technical details.

Instead of presenting:

4,382 IDS alerts were generated.

Leadership may need to know:

Three critical security risks remain unresolved and could affect customer-facing services.

7. Executive Leadership

Executive leadership translates organizational strategy into operational priorities.

Relevant executives may include:

Chief Executive Officer — CEO
Chief Information Officer — CIO
Chief Information Security Officer — CISO
Chief Risk Officer — CRO
Chief Financial Officer — CFO
Chief Privacy Officer — CPO
Chief Compliance Officer — CCO

These leaders participate in:

Risk decisions.
Security funding.
Policy approval.
Risk acceptance.
Incident escalation.
Compliance oversight.

8. The Role of the CISO

The Chief Information Security Officer typically leads the cybersecurity program.

Common responsibilities include:

Security strategy.
Security governance.
Risk management.
Security architecture.
Security operations.
Incident response.
Compliance coordination.
Executive reporting.
Security awareness.
Security investment.

The CISO connects technical cybersecurity with business leadership.

A mature CISO does not simply report:

We need another security tool.

Instead, the CISO may explain:

Our current identity controls leave privileged accounts exposed to account takeover. Strengthening authentication would materially reduce this risk.

9. The Role of GRC

The GRC function often supports governance by providing structure.

Typical activities include:

Maintaining policies.
Coordinating risk assessments.
Tracking risk acceptance.
Maintaining governance documentation.
Mapping regulatory requirements.
Monitoring control compliance.
Preparing executive risk reports.
Coordinating governance meetings.
Tracking remediation actions.
Maintaining risk and control registers.

GRC therefore acts as an important bridge between:

Business
   ↕
Leadership
   ↕
Risk
   ↕
Security
   ↕
Compliance

10. Roles and Responsibilities

One of the most important governance tasks is assigning clear responsibility.

For example:

Activity	Responsible Role
Approve security policy	Executive Leadership
Define security standards	Security Leadership
Implement MFA	IAM Team
Own application risk	Business Owner
Test security controls	GRC / Audit
Accept residual risk	Authorized Risk Owner
Monitor security alerts	SOC
Report cyber risk	CISO

Without defined ownership, issues can remain unresolved.

11. The RACI Model

Organizations often use the RACI model to clarify responsibilities.

RACI stands for:

Responsible
Accountable
Consulted
Informed

Example:

Activity	CISO	GRC	IAM Team	Business Owner
Define MFA policy	A	R	C	I
Implement MFA	I	C	R	A
Test compliance	I	R	C	I
Accept exception	C	R	I	A

Where:

R = Performs the work
A = Ultimately accountable
C = Provides input
I = Receives information

A good governance model avoids situations where multiple people assume someone else is responsible.

12. Security Policy Governance

Policies are one of the primary tools of governance.

A policy establishes organizational expectations.

Examples include:

Information Security Policy
Access Control Policy
Acceptable Use Policy
Incident Response Policy
Data Classification Policy
Risk Management Policy
Third-Party Risk Policy
Password Policy
Cloud Security Policy
Business Continuity Policy

Policies should not simply exist as documents.

They must be:

Created
   ↓
Reviewed
   ↓
Approved
   ↓
Published
   ↓
Communicated
   ↓
Implemented
   ↓
Monitored
   ↓
Updated

13. Policy Ownership

Every policy should normally have an owner.

For example:

Policy:
Information Security Policy

Policy Owner:
CISO

Approved By:
Executive Leadership

Review Frequency:
Annually

Version:
3.1

Last Review:
January 2026

The policy owner is responsible for ensuring that the document remains relevant.

14. Policy Hierarchy

Organizations often structure governance documentation as:

Policy
   │
   ▼
Standard
   │
   ▼
Procedure
   │
   ▼
Guideline

Example:

Policy

All sensitive information must be protected.

Standard

Sensitive data must use approved encryption algorithms.

Procedure

Steps for enabling database encryption.

Guideline

Recommendations for secure key management.

This hierarchy allows governance requirements to be translated into operational practices.

15. Security Standards

Standards define mandatory requirements.

Examples:

MFA must be enabled for all privileged accounts.

Critical vulnerabilities must be remediated within 15 days.

Administrative sessions must be logged.

Sensitive data must be encrypted at rest.

Standards are usually more specific than policies.

16. Security Procedures

Procedures explain how work must be performed.

For example:

Procedure:
Privileged Account Creation

1. Manager submits access request.
2. Business owner approves request.
3. IAM team creates account.
4. MFA is enabled.
5. Access is logged.
6. Account is reviewed quarterly.

Procedures turn governance expectations into repeatable activities.

17. Governance Committees

Large organizations often establish committees to support governance.

Common examples include:

Cybersecurity Steering Committee.
Information Security Committee.
Enterprise Risk Committee.
Architecture Review Board.
Data Governance Committee.
Change Advisory Board.
Third-Party Risk Committee.

These groups provide formal decision-making forums.

18. Security Steering Committee

A Security Steering Committee may include:

CISO
CIO
Risk Leadership
Legal
Compliance
IT Operations
Business Leaders
GRC
Privacy

Typical agenda items may include:

Major security risks.
Security program status.
Regulatory requirements.
Critical findings.
Security investments.
Major incidents.
Risk acceptance decisions.

19. Risk Ownership

Every significant risk should have an owner.

The risk owner is usually someone with authority over the affected business process.

Example:

Risk:
Customer portal outage

Risk Owner:
Head of Digital Services

The CISO may identify the cybersecurity risk.

The GRC team may assess and document it.

But the business owner may ultimately accept or remediate the risk.

This distinction is important.

20. Security Team vs Risk Owner

The security team does not necessarily own every cyber risk.

For example:

Security Team:
Identifies vulnerability

GRC:
Evaluates business risk

Business Owner:
Determines business impact

Technology Team:
Implements remediation

Authorized Executive:
Accepts residual risk

This prevents cybersecurity from becoming solely responsible for business decisions.

21. Risk Acceptance Governance

Organizations sometimes choose to accept risk.

Risk acceptance should not occur informally.

A formal process might include:

Risk Identified
      │
      ▼
Risk Assessment
      │
      ▼
Recommended Treatment
      │
      ▼
Business Justification
      │
      ▼
Risk Owner Approval
      │
      ▼
Expiration Date
      │
      ▼
Periodic Review

Risk acceptance should include:

Risk description.
Business impact.
Current controls.
Residual risk.
Justification.
Owner.
Approval.
Review date.

22. Security Exceptions

Sometimes organizations cannot immediately comply with a policy.

Example:

Policy:
All systems must support MFA.

Problem:
Legacy application does not support MFA.

The organization may request a temporary exception.

A proper exception process should include:

Reason for exception.
Risk assessment.
Compensating controls.
Owner.
Approval.
Expiration date.
Remediation plan.

Exceptions should never become permanent by default.

23. Compensating Controls

A compensating control provides an alternative method of reducing risk.

Example:

Required Control:
MFA

Unavailable:
Legacy system cannot support MFA

Compensating Controls:
Restricted network access
Privileged access monitoring
Stronger password requirements
Session logging

The organization must evaluate whether these controls sufficiently reduce the risk.

24. Segregation of Duties

Security governance should prevent excessive concentration of authority.

This principle is called Segregation of Duties, or SoD.

For example:

The same employee should not be able to:

Request privileged access
        +
Approve privileged access
        +
Create privileged account
        +
Review privileged access

Separating these responsibilities reduces fraud, error, and misuse.

25. Least Privilege Governance

Governance also establishes expectations for access.

The principle of least privilege means users should receive only the permissions required for their role.

Example:

Finance Employee
        │
        ▼
Finance Systems
        │
        ✖
        ▼
Production Administrator Access

Governance establishes the principle.

IAM teams implement the technical controls.

26. Security Strategy

Security governance should support a documented security strategy.

The strategy may include objectives such as:

Improve identity security.
Reduce cloud risk.
Strengthen ransomware resilience.
Improve vulnerability management.
Increase security awareness.
Improve regulatory compliance.
Establish Zero Trust.
Improve security monitoring.

The strategy should be connected to business goals.

27. Business Alignment

A security program should not exist independently of business priorities.

Suppose the business plans to expand cloud services.

Security governance may establish objectives such as:

Business Strategy:
Increase cloud adoption
        │
        ▼
Security Governance:
Establish cloud security standards
        │
        ▼
Security Program:
Cloud IAM
Cloud logging
Configuration monitoring
Cloud security architecture

Security therefore enables the business rather than simply restricting it.

28. Risk Appetite

Governance helps leadership define risk appetite.

Risk appetite describes the amount and type of risk an organization is willing to accept.

For example:

Customer Data:
Very Low Risk Appetite

Internal Development Systems:
Moderate Risk Appetite

Experimental Technology:
Higher Risk Appetite

Not all systems require identical levels of control.

29. Risk Tolerance

Risk tolerance defines acceptable variation around risk objectives.

Example:

Risk Appetite:
Low tolerance for critical outages

Risk Tolerance:
Maximum 30 minutes downtime for payment platform

These statements help teams understand acceptable operating boundaries.

30. Security Governance Metrics

Leadership needs measurable information.

Common governance metrics include:

Number of critical risks.
Number of overdue remediation actions.
Policy compliance percentage.
Vulnerability remediation performance.
Number of security exceptions.
Number of high-risk vendors.
Incident trends.
Access review completion.
Security awareness completion.
Audit finding closure rates.

Metrics should help leadership make decisions.

31. KPI vs KRI

Two important governance concepts are KPIs and KRIs.

KPI — Key Performance Indicator

Measures how effectively a security activity is being performed.

Example:

98% of critical vulnerabilities remediated within SLA.

KRI — Key Risk Indicator

Provides warning that risk may be increasing.

Example:

25% increase in critical vulnerabilities older than 30 days.

A KPI focuses on performance.

A KRI focuses on risk exposure.

32. Executive Security Dashboard

A security dashboard may show:

Critical Risks               5
High-Risk Vendors            8
Open Audit Findings         12
Critical Vulnerabilities    21
Policy Exceptions            7
Security Incidents           3

However, the numbers alone are not enough.

Good governance reporting explains:

Why the metric matters.
Whether the trend is improving.
Which business services are affected.
Whether executive action is required.

33. Escalation

Governance must define when security issues should be escalated.

For example:

Low Risk
→ Operational Team

Medium Risk
→ Security Manager

High Risk
→ CISO

Critical Risk
→ Executive Leadership / Board

Organizations should establish escalation thresholds.

34. Decision-Making Authority

Governance should clearly define who has authority to make decisions.

Examples:

Decision	Authority
Approve security policy	Executive Leadership
Approve technical standard	CISO
Accept low risk	Business Manager
Accept critical risk	Executive Leadership
Approve security exception	Authorized Risk Owner
Approve system go-live	Business / Technology Leadership

Ambiguous decision authority creates delays and unmanaged risk.

35. Three Lines Model

Many organizations use the Three Lines Model for risk governance.

First Line

Business and operational teams.

They own and manage risk.

Examples:

IT.
Engineering.
Finance.
Operations.

Second Line

Risk, compliance, and security oversight functions.

They provide guidance and monitoring.

Examples:

GRC.
Enterprise Risk.
Compliance.
Information Security.

Third Line

Internal Audit.

Provides independent assurance.

First Line
Business Operations
       │
       ▼
Own & Manage Risk

Second Line
Risk / Compliance / GRC
       │
       ▼
Monitor & Challenge

Third Line
Internal Audit
       │
       ▼
Independent Assurance

36. Internal Audit Independence

Internal Audit should remain independent from the activities it evaluates.

For example, the same team should not:

Design the control
        +
Operate the control
        +
Audit the control

Independent assurance strengthens governance.

37. Security Governance and Compliance

Compliance requirements often influence governance.

For example:

PCI DSS may require certain security controls.

ISO 27001 may require management oversight.

SOC 2 may require evidence of control effectiveness.

Governance ensures these requirements become organizational responsibilities rather than isolated audit activities.

38. Security Governance and Cloud

Cloud environments require clear governance.

Organizations should define:

Who can create cloud accounts.
Which regions may be used.
How identities are managed.
How sensitive data is stored.
Which services are approved.
How logging is configured.
How cloud costs are controlled.
How security exceptions are handled.

Without cloud governance, teams may create uncontrolled environments.

This is often referred to as cloud sprawl.

39. Security Governance and Third Parties

Governance should also define how vendors are managed.

For example:

Vendor Selected
      │
      ▼
Security Assessment
      │
      ▼
Risk Classification
      │
      ▼
Contract Review
      │
      ▼
Security Requirements
      │
      ▼
Approval
      │
      ▼
Ongoing Monitoring

High-risk vendors may require stronger oversight.

40. Security Governance and AI

Organizations increasingly need AI governance.

Security and GRC teams may establish requirements covering:

Approved AI services.
Sensitive data usage.
Model access.
Privacy.
AI-generated content.
Third-party AI platforms.
Data retention.
AI security testing.
Regulatory compliance.

Governance helps organizations benefit from AI while controlling risk.

41. Governance Documentation

Common governance documents include:

Information Security Charter.
Information Security Policy.
Risk Management Policy.
Governance Framework.
Security Strategy.
Roles and Responsibilities Matrix.
RACI Matrix.
Risk Appetite Statement.
Security Standards.
Committee Terms of Reference.
Exception Management Procedure.
Risk Acceptance Form.
Executive Security Reports.

GRC professionals may create, maintain, or review many of these artifacts.

42. Governance Meeting Example

A monthly security governance meeting could include:

1. Review previous actions
2. Review critical enterprise risks
3. Discuss major security incidents
4. Review compliance findings
5. Review overdue remediation
6. Review policy exceptions
7. Review major projects
8. Discuss regulatory changes
9. Approve risk decisions
10. Assign new actions

Governance meetings should result in measurable decisions and actions.

43. Governance Decision Record

Important decisions should be documented.

Example:

Decision:
Continue operation of legacy application.

Risk:
Application does not support MFA.

Compensating Controls:
Network restriction
Enhanced monitoring
Privileged access controls

Risk Owner:
Business Application Director

Decision:
Risk accepted for six months.

Review Date:
31 December 2026

This provides accountability and audit evidence.

44. Common Governance Failures

Weak governance programs often suffer from:

No clear security ownership.
Outdated policies.
Risk decisions made informally.
No executive risk reporting.
Security exceptions without expiration.
Poor communication between business and security.
Audit findings remaining open indefinitely.
Security treated only as an IT responsibility.
No defined risk appetite.
Policies that are never enforced.

These problems usually indicate governance weaknesses rather than purely technical weaknesses.

45. Practical Governance Scenario

Imagine an organization discovers that a critical customer application is running an unsupported operating system.

The security team recommends replacement.

The business team says replacement will require six months.

A mature governance process may look like this:

Security identifies issue
        │
        ▼
GRC performs risk assessment
        │
        ▼
Business owner evaluates impact
        │
        ▼
Compensating controls defined
        │
        ▼
Risk formally accepted
        │
        ▼
Executive approval obtained
        │
        ▼
Remediation deadline established
        │
        ▼
Risk monitored until closure

Without governance, the application might simply continue operating indefinitely.

46. The GRC Professional’s Role in Governance

As a GRC professional, you may be responsible for:

Preparing governance reports.
Maintaining policy libraries.
Tracking security exceptions.
Coordinating governance committees.
Documenting risk decisions.
Maintaining risk ownership.
Supporting security strategy.
Creating RACI matrices.
Monitoring remediation actions.
Preparing executive dashboards.
Reviewing policies.
Escalating overdue risk items.

You are helping the organization turn cybersecurity concerns into structured business decisions.

47. Governance Mindset

When reviewing a security issue, ask:

Who owns this?

Who is accountable?

What policy applies?

What risk exists?

Who can accept the risk?

What controls are required?

What evidence exists?

Who needs to be informed?

Does this need escalation?

When will it be reviewed again?

These questions form the foundation of security governance.

Key Takeaways

Security governance establishes direction, authority, accountability, and oversight.
Governance determines what security objectives the organization should achieve.
Management implements the required activities and controls.
The Board and executive leadership provide high-level cybersecurity oversight.
The CISO typically leads the cybersecurity program.
GRC provides structure around policies, risk, reporting, compliance, and governance.
Every major risk should have an identified owner.
Risk acceptance should be formally documented and approved.
Policies, standards, procedures, and guidelines form a governance hierarchy.
RACI matrices help clarify organizational responsibilities.
KPIs measure performance, while KRIs provide indicators of changing risk.
Governance should align cybersecurity with business objectives.
Security exceptions should be approved, monitored, and time-limited.
Governance is ultimately about making informed and accountable security decisions.

Knowledge Check

Before continuing, make sure you can answer these questions:

What is security governance?
What is the difference between governance and management?
What role does the Board play in cybersecurity?
What are the responsibilities of the CISO?
What does RACI stand for?
Who should normally own business risk?
What is a security exception?
What is a compensating control?
What is the difference between a KPI and a KRI?
What are the Three Lines?
Why should risk acceptance be documented?
Why is executive reporting important?

What’s Next?

➡️ Next: 03 — Enterprise Risk Management

In the next lesson, you will move from organizational governance into the enterprise risk management process.

You will learn how organizations identify, analyze, evaluate, prioritize, treat, monitor, and report risks across technology and business environments.

You will also begin working with concepts such as risk registers, risk ownership, inherent risk, residual risk, likelihood, impact, risk scoring, risk treatment, and enterprise risk reporting.

These concepts will prepare you for the practical risk assessment methodology covered in the following lessons.