Security Governance
What is Security Governance?
The set of responsibilities and practices exercised by the board and executive management to provide strategic direction and oversight for information security.
Terms that appear alongside security governance
Each of these is named in at least one of the same controls as security governance. The number is how many controls name both.
- governance 58 shared controls
- information security 46 shared controls
- policy 12 shared controls
- roles and responsibilities 8 shared controls
- risk appetite 7 shared controls
- policy framework 7 shared controls
- security policy framework 7 shared controls
- security program management 6 shared controls
Frameworks that govern security governance
What the standards actually require on security governance
Requirements naming security governance across 6 standards, quoted from the control text.
Establishment of leadership, institutions and responsibilities to coordinate cyber security.
MALABO-Art26 · Cyber Security Governance and Leadership →Establish a formal governance framework for CDR data information security risk, document practices and responsibilities including those of senior management, maintain an information security policy, and review the framework at least annually.
AUCDR-IS-STEP1 · Step 1 - Define and implement security governance for CDR data →Defence and its partners must establish security governance (accountable authority, roles and responsibilities), manage security risk, foster a positive security culture, and provide assurance over the security of people, information and assets.
DSPF-GOV-PRIN · Security governance, risk management and culture →Security governance structure. Control from NIST SP 1800-32 framework, domain: NIST SP 1800-32: Asset Identification & Governance.
NIST1800-32-03 · Security governance structure →Requirement 0016 (Part One: Governance, section 2.5 Entity Protective Security Roles and Responsibilities; applies to All entities; dated 31 October 2024;
protective-security-policy-framework-pspf-release-2026::0016 · 0016 Accountable Authority approves tailored security governance →The company always has appropriate and proportionate security measures in place so it is ready to respond under its plan, signed off by the senior person it appoints as responsible for security measures.
uk-security-and-emergency-measures-direction-semd-water-industry::11 · Security governance and readiness →Questions people ask about security governance
What is Security Governance?
Why is Security Governance important for compliance?
Which compliance frameworks address Security Governance?
Where can I learn more about Security Governance?
See how Security Governance applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.