Security Governance + Types of Governance Structures + Understanding Policy Documents

Security Governance

programs are the sets of procedures and controls put in place to allow an organization to effectively direct it’s work

Centralized governance

models use a top-down approach where a central authority creates policies and standards, which are then enforced throughout the organization

Decentralized governance models

use a bottom-up approach, where individual business units are delegated the authority to achieve cybersecurity objectives and then may do so in the manner they see fit

An organization’s information security policy framework

contains a series of documents designed to describe the organization’s cybersecurity program