Section 11: Governance and Compliance

governance

overall management of the organization’s IT infrastructure, pollicies, procedures, and operations

compliance

adherence to laws, regulations, standards, and policies that apply to the operations of the organization

governance structures

1. boards

2. committees

3. governement entities

4. centralized and decentralized

boards

elected by shareholders to set strategic direction, policies, and major decision

committees

subgroup of boards that focus on detailed attention to complex areas

government entities

establish laws and regulations for compliance

centralized structures

decision making authority at top management levels that ensure consistent decions and clear authority

decentralized structures

decison making authority distributed throughout the organization making it a quicker than centralized structures but potentially inconsisent

acceptable use policy (AUP)

the do’s and don’ts for users when interacting with an organizationa IT systems and resources

information security policies

outlines how an organization protects its information assets from internal and external threats

• enforces CIA

business continuity policy

ensures operations continue during and after disruptions

disaster recovery policy

focuses on IT systems and data recovery/backup after disasters

incident response policy

addresses detection, reporting, assessment, response, and learning from security incidents

software development lifecycle (SDLC) policy

guides software development stages for requirements to maintenance

change management policy

handling of IT system/process changes

• controlled, coordinated change implementation to minimize disruptions

access control models

• discretionary (DAC)

• mandatory (MAC)

• role based (RBAC)

regulatory considerations

comply with regulations depending on industry and locatin

legal considerations

complement regulatory considerations, encompassing contract, intellectual property, and corporate law

industry considerations

indsutry-specific standards, practices, and guidelines

geographical considerations

regulations that impact organizations at local, regional, national, and global levels

types of compliance reporting

• internal

• external

due care

mitigating identified risks

attestation

formal declaration by a responsible pary that the organization’s processes and controls are compliant

sanctions

strict measures by regulatory bodies to enforce compliance

• range from restrictions to bans