Information security governance
Governance structures and accountability
20 min
Governance sets direction, risk appetite and accountability; management runs the controls. The board owns the risk, the CISO runs the program, system and data owners accept residual risk for what they own.
| Role | Accountable for |
|---|---|
| Board / risk committee | Risk appetite, oversight, approval of the security strategy |
| CEO, CIO, CFO | Funding, priorities, enterprise risk decisions |
| CISO | Security program, policy, reporting risk posture to the board |
| Risk owner (business) | Treatment decision and acceptance of residual risk |
| Data / system owner | Classification, access approval, control requirements |
| Custodian (IT ops) | Operating the controls: backups, patching, access provisioning |
| Internal audit | Independent assurance to the board |
The IIA Three Lines Model (2020) separates who owns risk, who oversees it and who assures it.
| Line | Who | Role |
|---|---|---|
| First | Operational management, IT ops, product teams | Own and manage risk; run controls |
| Second | Risk management, compliance, security GRC | Set frameworks, monitor, challenge the first line |
| Third | Internal audit | Independent assurance to the governing body |
| Document | Level | Approved by | Example |
|---|---|---|---|
| Policy | What and why; mandatory | Executive / board | All data is classified by sensitivity. |
| Standard | Specific mandatory rule | CISO | AES-256 for data at rest. |
| Procedure | Step-by-step how | Control owner | Quarterly access review steps. |
| Guideline | Recommended practice | Security team | Passphrase advice. |
IT does not accept business risk. A risk acceptance signed only by the security team has no authority; the business risk owner signs.
Word bank
All definitions →- Information assurance
- Confidence that information keeps its confidentiality, integrity, availability, authenticity and non-repudiation.
- Risk owner
- The person with authority and accountability to manage a given risk.
- Three Lines Model
- IIA model: first line owns risk, second line oversees, third line (audit) assures.
Knowledge check
Who signs acceptance of residual risk on a customer billing system?
Internal audit sits in which line?