You Probably Need a Security Governance Committee, and Here’s Why

Any effective security governance committee is responsible for three primary roles, as follows:

• Information Security. Governance committee responsibilities begin with the development and maintenance of appropriate information security programs for the organization. These may encompass electronic data security, cloud security, and physical security programs.
• Regulatory Compliance. The security governance committee is responsible for understanding information security regulations that apply to your industry, and for documenting ownership of regulatory compliance within your organization. The committee ensures that regulatory requirements are addressed through the development, execution, and maintenance of company-wide best practices for information security, as well as for third-party vendor information security.
• Collaboration and Steering. The committee also serves as a forum for discussions, updates, and upgrades related to information security initiatives, security policies and procedures, security controls, security metrics, and KPIs, current security assessments and investigations, data security risks, and strategic security issues.

In pursuing these objectives, the security governance committee provides high-level leadership and aid to the organization in enabling effective security and acceptable business risk.

Benefits of a Security Governance Committee

Your organization will enjoy a number of benefits by establishing a committee dedicated to governing your security program. These include:

• Effectively managing your organization’s information security risks, including internal and external threats and vulnerabilities.
• Enhancing security compliance initiatives to meet all regulatory requirements that apply to your industry and your organization.
• Putting your company in the best position to respond successfully to advances in technology, shifts in security regulations and best practices, and changes in key security leadership.
• Enabling your security budget to be allocated intelligently and optimally, based on a big-picture view of the organization’s security needs and priorities.

There are other benefits as well. Can you think of one or two we haven’t mentioned?

Considerations When Forming Your Committee

Committee Status. Your security governance committee it is not and should not become an information technology (IT) governance committee. IT is a subset of security, not the other way around. Security is a significant business risk and top-level management concern—not just an IT problem.

Committee Membership. To enable the best strategic decision-making possible, make the security governance committee as inclusive as it needs to be. Roles appropriate for committee members include the chief information security officer, IT director, and corporate risk manager.

Directors of the organization’s functional lines should be included, such as human resources, accounting, and finance, research and development, production, marketing. If the organization has satellite locations, it’s appropriate to include regional directors and other key field managers. The point is to have thorough representation at high-enough levels.

Committee Agility. Be prepared to adjust membership as security priorities shift over time, to ensure appropriate stakeholders are engaged. This will ensure the committee remains relevant and timely, and also help to effectively target security spending.

Committee Management. Plan to meet quarterly at a minimum. It’s important to communicate the purpose of the committee, its corporate charter, and its membership. Responsibilities should be assigned as evenly as feasible among members, and all should be encouraged to actively engage. Use agendas to keep your meetings focused and adhere to them to avoid losing the attention of your busy committee members. And when communicating with committee members, make every effort to be even-handed and speak in business terms as you moderate the committee toward effective solutions and decisions.

A security governance committee is at the heart of any effective security program. It helps to integrate all aspects of an organization’s security in a cohesive, holistic manner to enable optimal decision-making. As such, it is vitally important to the security of your organization at every level.

Need Help?

Many organizations understand the need for a security governance committee but are unable to dedicate the resources to establishing the committee, developing the charter, and managing the committee so it can do its job. Outsourcing these tasks to an expert is a popular and viable option.

In particular, a Virtual Chief Information Security Officer (VCISO) is an ideal catalyst to ensure that the security governance committee is properly formed and understands its responsibilities to the organization and its various stakeholders. The VCISO will assist in developing your committee charter, outlining and assigning responsibilities, and guiding and advising in other ways.

Summary

In general terms, governance is the act of administering, directing or guiding a program, institution, city, or nation. Security governance is the process of overseeing the security and cybersecurity teams who are responsible for mitigating an organization’s business risks.

Security teams do not operate unilaterally. Security programs have many moving parts and require high-level oversight. A security governance program provides authoritative attention and collaborative guidance across those moving parts to ensure an integrated, holistic approach to security for the entire organization.

At the center of a security governance program is the security governance committee, whose roles encompass information security, regulatory compliance, and collaboration and steering. Without such a committee, an organization’s security program is likely to lack focus and management support and result in sub-optimal decision-making.