Security Standards White Papers

Information Security Governance: Guidance for Board of Directors and Executive Management

• Tags:
• security standards,
• governance,
• directors,
• executive

Overview The growth and success of nearly all enterprises rely on harnessing information technology (IT) for secure, profitable use. All enterprises benefit from an integrated and comprehensive approach to risk management, security and control.

As organisations continue to take advantage of the opportunities available through global networking, and need to comply with existing or new security laws and regulations, difficult decisions arise about how much money to invest in IT security and control. Enterprises must consider the best ways to offer flexibility to customers and trading partners, yet ensure security of critical information and systems for all its users.

While executive management has the responsibility to consider and respond to these issues, boards of directors will increasingly be expected to make information security an intrinsic part of governance, preferably integrated with the processes they have in place to govern IT.

In this regard, governing boards and executive management should review:
• The scale and cost of the current and future investments in information
• The potential for technologies to dramatically change organisations and business practices, create new opportunities, and reduce costs

They should also consider the associated ramifications:
• The increasing dependence on information and the systems and communications that deliver the information
• The dependence on entities beyond the direct control of the enterprise
• The impact on reputation and enterprise value resulting from IT failures

To exercise effective enterprise and IT governance, boards of directors and executive management must have a clear understanding of what to expect from their enterpriseÂ’s information security programme. They need to know how to implement an effective information security programme, how to evaluate their own status with regard to the security programme in place and how to decide what securit

• 
• Did you find this white paper useful? 3 out of 4 users found this white paper useful

• Subscribe to the IT White Papers Newsletter
• White Paper RSS