Security Governance, Ethics and Professional Accountability

Introduction

Cybersecurity is not only a technical activity. It is also a governance, legal, ethical and professional responsibility. Firewalls, encryption, identity controls and monitoring systems are valuable only when an organisation has clearly defined authority, responsible decision-making and mechanisms for accountability. Security failures frequently result not from the complete absence of technology, but from unclear ownership, poor policy, conflicts between business objectives and security requirements, or decisions that disregard ethical and legal obligations.

Security governance is the system by which an organisation directs, controls and evaluates its protection of information and technology. It connects organisational strategy with risk management, policies, resources, assurance and accountability. Ethics provides principles for deciding what should be done, particularly when the law does not provide a complete answer. Professional accountability requires individuals to perform their duties competently, honestly and with appropriate regard for users, colleagues, employers and the public.

This chapter examines the responsibilities of boards, senior management, security leaders and operational teams. It explains how security policies are developed, how accountability is assigned, and how difficult issues such as surveillance, disclosure, whistleblowing and conflicts of interest can be managed.

Learning Objectives

By the end of this chapter, students should be able to:

1. Explain the meaning and purpose of cybersecurity governance.
2. Distinguish the responsibilities of the board, senior management, security leadership and operational staff.
3. Develop a policy structure that supports security, compliance and business objectives.
4. Assign responsibility using suitable accountability models.
5. Apply ethical principles to surveillance, monitoring, disclosure and conflicts of interest.
6. Explain professional duties and codes of conduct in cybersecurity.
7. Analyse a governance failure and recommend practical improvements.

1. The Meaning and Scope of Security Governance

Security governance is the leadership and oversight framework used to ensure that information security supports organisational objectives and manages risk within an acceptable level. It includes decision rights, reporting relationships, policies, risk acceptance, resource allocation, assurance and review.

Governance differs from management and operations:

• Governance determines direction, establishes accountability and oversees performance.
• Management converts direction into plans, budgets, processes and controls.
• Operations performs daily activities such as access administration, monitoring, incident response and system maintenance.

These activities are connected but should not be confused. A security operations centre may detect suspicious activity, but it normally does not decide the organisation’s overall risk appetite. A board may approve a risk strategy, but it should not alter firewall rules directly.

Effective governance has several characteristics:

• Alignment: security supports the organisation’s mission and legal obligations.
• Accountability: named individuals are responsible for decisions and outcomes.
• Risk orientation: resources are directed toward significant threats and impacts.
• Independence: assurance and challenge are not controlled entirely by the people being assessed.
• Transparency: decisions, exceptions and incidents are documented and reported honestly.
• Continuous improvement: governance adapts to new technologies, threats and regulation.

Governance frameworks such as ISO/IEC 27001, the NIST Cybersecurity Framework and COBIT can help organisations structure these activities. They are not substitutes for judgement. A framework must be adapted to organisational size, sector, legal environment, technology and risk profile.

2. Organisational Responsibilities

2.1 The Board of Directors

The board has ultimate oversight responsibility for the organisation’s governance and risk management. It does not need to perform technical tasks, but it must ask informed questions and ensure that cybersecurity is treated as an enterprise risk rather than merely an IT problem.

Board responsibilities commonly include:

• approving or overseeing the security strategy;
• ensuring that major cyber risks are identified and managed;
• confirming that sufficient resources and expertise are available;
• reviewing significant incidents and remediation plans;
• overseeing legal, regulatory and contractual compliance;
• ensuring that management reports are accurate and not misleading;
• monitoring whether risk decisions are consistent with organisational objectives; and
• challenging management when security weaknesses are ignored or repeatedly deferred.

A board should not rely solely on the absence of reported incidents as evidence of security. No reported incident may mean that controls are effective, or it may mean that detection and reporting are inadequate.

2.2 Senior Management

Senior management translates board direction into operational programmes. The chief executive, chief information officer, chief information security officer (CISO), risk officer, legal counsel, human resources leaders and business-unit executives may all have relevant responsibilities.

Management should:

• establish security policies and procedures;
• define risk appetite and escalation thresholds;
• approve security budgets and staffing;
• integrate security into procurement, projects and change management;
• ensure training and awareness;
• maintain incident response and business continuity capabilities;
• appoint control owners;
• review exceptions and risk acceptance; and
• provide accurate reports to the board and regulators.

The CISO often leads security strategy, but the CISO is not automatically the sole owner of every cyber risk. Business managers own the risks associated with their processes and information assets. The CISO provides expertise, coordination, control design and assurance. Concentrating all accountability in the security department can allow business leaders to avoid responsibility for decisions that create risk.

2.3 The Security Team

Security teams design, implement, monitor and improve controls. Their responsibilities may include vulnerability management, identity and access management, security architecture, security testing, threat detection, incident response, digital forensics, awareness and compliance support.

Security professionals must work within authorised boundaries. Technical ability does not create permission. For example, a penetration tester must have a written scope, approved dates, permitted techniques, emergency contacts and rules for handling discovered data. A security analyst must not browse personal records merely because technical access is available.

Security teams should also maintain evidence of their work. Records may include risk assessments, access reviews, incident tickets, test reports, approvals, exceptions and remediation evidence. Documentation supports accountability and helps distinguish a good-faith mistake from reckless or unauthorised conduct.

2.4 Users, Contractors and Suppliers

Every employee and contractor has a duty to follow policies, protect credentials, report suspected incidents and use information only for authorised purposes. Suppliers may process personal or confidential information and therefore require due diligence, contractual controls, monitoring and clear incident-reporting obligations.

Accountability must extend across the supply chain. An organisation cannot assume that outsourcing a service transfers all legal or ethical responsibility. Contracts should address security requirements, audit rights, data location, subcontracting, breach notification, retention, deletion and termination assistance.

3. Accountability, Responsibility and Assurance

The terms responsibility and accountability are related but distinct. Responsibility means performing an assigned task. Accountability means being answerable for the outcome and for explaining decisions. Several people may be responsible for parts of an activity, but accountability should normally be assigned clearly to a role or decision owner.

A useful practical tool is a RACI matrix:

A RACI matrix should not be used mechanically. It should identify real decision rights and avoid assigning multiple Accountable parties for one decision unless the governance structure genuinely requires joint approval.

Accountability is strengthened by separation of duties. The person requesting privileged access should not be the only person approving and reviewing that access. Likewise, an individual who develops a security control should not be the sole person validating its effectiveness. Separation reduces fraud, error and self-approval risks.

Assurance involves obtaining confidence that governance and controls operate as intended. Sources include internal audit, independent assessments, penetration tests, compliance reviews, management attestations, metrics and external certification. Assurance is not identical to compliance: a control may satisfy a documented requirement while failing to manage the underlying risk effectively.

4. Developing and Maintaining Security Policies

A policy is an authoritative statement of intent and required behaviour. It explains what the organisation requires and why. It should not attempt to contain every technical instruction. Detailed implementation belongs in standards, procedures and guidelines.

A practical hierarchy is:

1. Policy: mandatory organisational direction, such as the requirement to protect confidential information.
2. Standard: specific mandatory rule, such as minimum password or encryption requirements.
3. Procedure: ordered steps for carrying out a process, such as disabling a departing employee’s account.
4. Guideline: recommended advice where professional judgement is permitted.
5. Record or evidence: proof that an activity occurred, such as an access-review report.

A sound policy lifecycle includes:

1. Initiation: identify a legal, business, risk or technology need.
2. Analysis: identify stakeholders, affected information, threats and constraints.
3. Drafting: state purpose, scope, requirements, roles, exceptions and enforcement.
4. Consultation: obtain input from security, legal, privacy, human resources, operations and affected business units.
5. Approval: obtain authority from the designated owner or governance committee.
6. Communication: publish the policy in an accessible form and explain its practical meaning.
7. Implementation: create standards, procedures, training and technical controls.
8. Monitoring: assess compliance and effectiveness.
9. Review: update after a defined period or after major legal, technological or organisational change.
10. Retirement: withdraw obsolete versions while retaining appropriate records.

A policy should be clear about scope, definitions, roles, prohibited conduct, exceptions, reporting channels and consequences. Excessively broad wording can create uncertainty and unfair enforcement. For example, a policy that prohibits “all unauthorised use” should explain what constitutes authorised personal use, emergency use and approved security testing.

Policy exceptions should be documented, time-limited and approved by an appropriate risk owner. An exception should identify the reason, affected assets, compensating controls, expiry date and review method. Permanent exceptions are often evidence that the policy or system requires redesign.

5. Risk Appetite, Risk Acceptance and Escalation

No organisation can eliminate all cyber risk. Governance therefore requires decisions about which risks are acceptable, which require treatment and which must be escalated. Risk appetite is the general amount and type of risk an organisation is willing to pursue or retain. Risk tolerance defines acceptable variation around objectives or limits. Risk acceptance is a specific decision to retain a documented risk.

Risk acceptance should be made by the person or body with authority over the affected business objective and resources. A security analyst should not accept a major operational risk merely because management has not responded. The analyst should document and escalate the matter.

A practical risk statement identifies:

• the asset or process affected;
• the threat and vulnerability;
• the possible consequence;
• existing controls;
• residual risk;
• proposed treatment;
• decision owner; and
• review date.

Risk treatment options include avoiding the activity, reducing likelihood or impact, transferring some consequences through contracts or insurance, and accepting the residual risk. Transfer does not remove accountability for lawful and ethical conduct.

Useful governance metrics should support decisions rather than create an illusion of precision. Examples include the age of critical vulnerabilities, percentage of privileged accounts reviewed, time to contain incidents, completion of remediation actions, policy exceptions past expiry and coverage of security training. Metrics require definitions and context. A high number of blocked attacks may reflect effective controls, increased attack volume or a poorly tuned detection system.

6. Ethics in Cybersecurity Practice

Law establishes minimum enforceable requirements; ethics addresses responsible conduct, including situations where several lawful choices have different consequences. Ethical reasoning is especially important in cybersecurity because professionals often possess unusual access, specialised knowledge and the ability to affect privacy, safety and reputation.

Important ethical principles include:

• Respect for autonomy: recognise individuals’ rights to make informed choices about themselves and their information.
• Beneficence: act to promote legitimate security and public benefit.
• Non-maleficence: avoid unnecessary harm, exposure, disruption or humiliation.
• Justice: distribute benefits, burdens and security protections fairly.
• Proportionality: ensure that an intrusive or restrictive measure is justified by the seriousness of the risk.
• Transparency: provide truthful explanations and avoid deceptive reporting.
• Confidentiality: protect information accessed through professional duties.
• Competence: accept work within one’s knowledge and seek assistance when necessary.

Ethical analysis can be structured as a sequence:

1. Define the facts and distinguish confirmed information from assumptions.
2. Identify affected stakeholders and possible harms.
3. Identify legal, contractual, policy and professional constraints.
4. Develop alternative actions, including doing nothing.
5. Evaluate necessity, proportionality, reversibility and fairness.
6. Consult an appropriate independent authority.
7. Choose, document and review the action.

This method does not produce a mathematical answer. It provides a disciplined way to expose hidden assumptions and make decisions defensible.

6.1 Surveillance and Employee Monitoring

Monitoring may protect systems, investigate misconduct and meet regulatory obligations. It may also intrude on privacy, create a chilling effect, expose sensitive information or discriminate against particular groups.

Before implementing monitoring, an organisation should establish a legitimate purpose, define the data collected, limit access, determine retention, communicate the practice and assess less intrusive alternatives. Monitoring should be proportionate to the risk. Collecting every keystroke indefinitely is difficult to justify when access logs or targeted investigation would achieve the same purpose.

The organisation should distinguish security telemetry from employee performance surveillance. Data collected for one purpose should not automatically be reused for another incompatible purpose. Privacy impact assessments, consultation with legal and human resources personnel, and technical controls such as access restrictions and retention limits are important safeguards.

6.2 Responsible Disclosure

Security researchers and professionals may discover vulnerabilities affecting an organisation or the public. Responsible disclosure seeks to reduce harm by notifying an appropriate party, providing enough information to reproduce the issue, protecting sensitive data and allowing reasonable time for remediation.

Organisations should publish clear vulnerability-reporting channels, acknowledge good-faith research, avoid retaliatory conduct where legally appropriate, and coordinate communications. Researchers should avoid unnecessary access, alteration or publication of data. If an organisation ignores a serious vulnerability, escalation may be justified, but public disclosure should consider exploitability, available mitigations, affected users and the risk of enabling attacks.

6.3 Conflicts of Interest

A conflict of interest exists when personal, financial, professional or relational interests could improperly influence professional judgement, or could reasonably appear to do so. Examples include recommending a supplier owned by a close relative, accepting significant gifts from a vendor, concealing a control weakness to protect a performance bonus, or auditing work one personally approved.

The appropriate response is disclosure, assessment and management. Possible controls include recusal, independent review, competitive procurement, gift restrictions and reassignment. A conflict is not necessarily misconduct; concealing or mishandling it may be.

6.4 Whistleblowing and Escalation

Professionals may encounter unsafe, unlawful or deceptive conduct. Normal escalation should usually proceed through a manager, security leadership, internal audit, legal counsel, ethics officer or designated reporting channel. If these channels are compromised or ineffective, external reporting may become appropriate, subject to applicable law and protection of confidential information.

A whistleblower should preserve factual evidence, avoid exaggeration, separate observation from interpretation and seek independent advice. Organisations should prohibit retaliation and investigate credible reports fairly. Retaliation discourages reporting and increases the chance that serious risks remain hidden.

7. Professional Codes of Conduct

Professional codes establish expectations for competence, integrity, confidentiality, respect and protection of the public. Examples include codes associated with (ISC)², ISACA, ACM and professional engineering bodies. A code does not replace law or organisational policy. It provides an additional standard of conduct and may guide disciplinary decisions.

Common professional duties include:

• protecting society, the public interest and the confidentiality of information;
• acting honestly and avoiding misleading statements;
• maintaining professional competence through education and practice;
• respecting authorisation boundaries;
• reporting material risks accurately;
• avoiding discrimination, harassment and abuse of power;
• preserving evidence and maintaining professional records; and
• accepting responsibility for errors and correcting them promptly.

Professionals should also understand the limits of their competence. Accepting a task involving industrial control systems, digital forensics or privacy law without suitable knowledge may create preventable harm. Competence includes knowing when to obtain specialist assistance.

8. Governance in Incident Response

Incident response demonstrates whether governance arrangements work under pressure. Before an incident, the organisation should define severity levels, authority to isolate systems, legal and regulatory notification responsibilities, evidence-handling procedures, communication roles and business continuity arrangements.

During an incident, responders must balance speed with preservation of evidence and avoidance of unnecessary disruption. The incident commander coordinates technical and business decisions, while legal and communications specialists advise on notification and public statements. Facts should be separated from hypotheses. Suppressing an incident to avoid reputational damage may create greater legal, ethical and operational harm.

After an incident, a lessons-learned review should examine root causes, control failures, decision quality, communication and unresolved risks. The purpose is improvement, not automatic blame. However, deliberate concealment, unauthorised access or reckless disregard for known risks must be addressed through appropriate disciplinary and legal processes.

9. Applied Case: The Unapproved Monitoring Programme

This is an illustrative fictional case.

Background

A medium-sized college experienced repeated account compromise. The IT director authorised the security team to deploy endpoint monitoring software. The software recorded application use, file names, screenshots during selected alerts and network destinations. The deployment was completed quickly, but the college had no approved monitoring policy, privacy assessment or retention schedule.

Problem

A security analyst discovered that the software captured counselling-session documents and union-related correspondence on several staff computers. The IT director argued that the monitoring was necessary and that publishing details might damage the college’s reputation. Human resources wanted to use the data to investigate employee productivity. The security team was uncertain whether it could disable the tool without creating security exposure.

Analysis

The legitimate security objective was account-compromise detection. However, the collection was broader than necessary, and secondary use for productivity assessment had not been communicated. The college lacked clear accountability, documented purpose limitation, access controls and retention rules. The issue involved privacy, employee trust, confidentiality, proportionality and possible legal obligations.

Approach and Solution

The CISO documented the facts and escalated them to the principal, privacy officer, legal counsel and governing risk committee. The college temporarily restricted access to captured data, disabled screenshot collection except for narrowly defined high-risk alerts, and preserved relevant evidence under controlled access. It prohibited use of the material for performance management pending review.

The college then completed a privacy and security assessment, consulted staff representatives, created a monitoring policy, established retention and deletion rules, and introduced role-based access. The monitoring purpose was limited to threat detection and incident investigation. A RACI matrix assigned the system owner accountability for business use, the CISO responsibility for security design, the privacy officer responsibility for privacy advice and the governing committee responsibility for oversight.

Outcome

The college retained targeted monitoring but removed unnecessary collection. It implemented periodic access reviews, published staff notices and required approval for future monitoring changes. The incident was reported to the governing committee, and the college evaluated whether any external notification was required under applicable law.

Learning Points

1. A legitimate security objective does not justify unlimited collection.
2. Technical deployment should follow policy, authorisation and impact assessment.
3. Purpose limitation prevents data collected for security from becoming general surveillance.
4. Accountability must be assigned before a high-impact system is deployed.
5. Transparency and proportionality support both ethical conduct and sustainable security.

10. Challenges and Contemporary Developments

Cloud and Supply-Chain Governance

Cloud services distribute responsibility among customers, providers and subcontractors. Organisations must understand the shared-responsibility model, verify supplier claims and maintain oversight of data access, configuration, logging and incident notification. A certification or contractual promise is useful evidence but not complete assurance.

Artificial Intelligence

AI systems create governance issues involving data provenance, confidentiality, bias, explainability, automation errors and accountability. An organisation should define who approves an AI use case, what data may be entered, how outputs are validated, when human review is mandatory and how errors are reported. An employee cannot avoid responsibility by claiming that an AI system produced the decision.

Generative AI can also expose confidential information through prompts, produce insecure code or create convincing misinformation. Policies should address approved tools, restricted data, verification, copyright and record keeping.

Remote and Hybrid Work

Distributed work increases dependence on identity assurance, endpoint management, secure collaboration and privacy-aware monitoring. Governance should avoid treating home workers as inherently untrusted while still applying strong controls based on risk.

Metrics and Assurance Fatigue

Organisations may produce many dashboards without improving control effectiveness. Governance bodies should focus on material trends, overdue actions, repeated exceptions and evidence that controls reduce risk. Independent challenge is particularly important when management reports are based mainly on self-assessment.

Best-Practice Checklist

A diploma-level practitioner should be able to verify that an organisation:

• has an approved security strategy and policy hierarchy;
• assigns named owners for important risks and information assets;
• separates governance, management and operational functions;
• documents risk acceptance and policy exceptions;
• maintains an incident escalation and notification process;
• controls privileged access and reviews it periodically;
• assesses privacy and ethical effects of monitoring;
• manages supplier and cloud responsibilities;
• provides accessible reporting channels for concerns;
• trains staff and measures meaningful outcomes; and
• reviews governance after incidents, audits and major change.

Chapter Summary

Security governance directs and oversees an organisation’s protection of information and technology. Governance establishes direction and accountability; management converts that direction into programmes and controls; operational teams execute daily security activities. Boards oversee strategy, risk and assurance, while management allocates resources, approves policies and ensures that risks are treated or accepted by authorised owners.

Policies should form a controlled hierarchy of policies, standards, procedures and guidelines. They require consultation, approval, communication, implementation, monitoring and review. RACI matrices, separation of duties, independent assurance and documented risk acceptance help make accountability practical.

Ethical cybersecurity practice requires more than legal compliance. Principles such as proportionality, confidentiality, competence, transparency, justice and non-maleficence guide decisions about surveillance, disclosure, conflicts of interest and whistleblowing. Monitoring should have a legitimate purpose, collect no more than necessary, protect collected data and be communicated appropriately. Professional codes reinforce duties to the public, employers, users and the profession.

Effective governance is demonstrated during difficult circumstances: incidents, supplier failures, privacy concerns and pressure to conceal weaknesses. Responsible professionals document facts, escalate concerns, respect authorisation boundaries and accept accountability for their decisions. Security governance is therefore both an organisational system and a professional commitment to trustworthy conduct.

Key Terms

Accountability: The obligation to answer for decisions, actions and outcomes.

Assurance: Evidence-based confidence that governance and controls operate as intended.

Board oversight: Direction and review of organisational strategy, risk and performance by the governing body.

Conflict of interest: A personal or external interest that could improperly influence professional judgement or appear to do so.

Control owner: The person accountable for ensuring that a specified control is designed, implemented and maintained.

Due care: Reasonable steps taken to identify and manage foreseeable risks.

Ethics: Principles used to evaluate responsible conduct, including where law is incomplete.

Governance: Direction, oversight, decision rights and accountability for organisational objectives and risk.

Incident commander: The person coordinating decisions and activities during a security incident.

Policy exception: An approved, documented and usually time-limited departure from a mandatory requirement.

Proportionality: The principle that an action’s intrusiveness or burden should be justified by the risk it addresses.

RACI: A responsibility model identifying Responsible, Accountable, Consulted and Informed roles.

Risk acceptance: An authorised decision to retain a documented residual risk.

Risk appetite: The amount and type of risk an organisation is generally willing to pursue or retain.

Separation of duties: Division of critical tasks among different people to reduce error, fraud and self-approval.

Surveillance: Monitoring people, activity or communications for a specified purpose.

Transparency: Honest communication about practices, decisions, limitations and risks.

Whistleblowing: Reporting suspected wrongdoing, danger or unlawful conduct through protected channels.

Review Questions

Short Answer Questions

1. Distinguish governance, management and operations in cybersecurity.
2. State four responsibilities of a board in security governance.
3. What is the difference between responsibility and accountability?
4. List the levels in a typical security policy hierarchy.
5. Why should security monitoring be proportionate to the risk?

Long Answer Questions

1. Explain how a board, senior management, CISO and security operations team should share cybersecurity responsibilities.
2. Describe the lifecycle for developing, approving, implementing and reviewing a security policy.
3. Explain how a RACI matrix and separation of duties can improve security accountability.
4. Discuss the ethical and governance issues involved in employee surveillance.
5. Explain the role of professional codes of conduct in cybersecurity practice.

Analytical / Application Questions

1. A business manager wants to accept a critical vulnerability risk because remediation may delay a product launch. Identify the governance process, evidence and approvals required before the risk can be accepted.
2. A researcher discovers that a hospital website exposes patient records but cannot find a vulnerability-reporting contact. Analyse the researcher’s ethical options and propose a responsible escalation path.
3. An organisation uses an AI tool to analyse employee emails for insider-threat indicators. Design a governance and ethics review covering purpose, proportionality, access, retention, human review, bias and accountability.

Multiple Choice Questions with Answers

Question 1

Which body has primary responsibility for overseeing organisational cybersecurity risk and strategy?

A. The board of directors

B. The security operations centre

C. The help-desk team

D. An individual system administrator

Correct Answer: A. The board of directors

Question 2

In a RACI matrix, which role owns the outcome and approves the decision?

A. Responsible

B. Accountable

C. Consulted

D. Informed

Correct Answer: B. Accountable

Question 3

Which document normally contains detailed ordered steps for carrying out a security process?

A. Policy

B. Standard

C. Procedure

D. Mission statement

Correct Answer: C. Procedure

Question 4

What is the most appropriate response to a conflict of interest?

A. Conceal it if no harm has occurred

B. Disclose and manage it through controls such as recusal or independent review

C. Transfer all organisational data to the interested party

D. Ignore it unless a regulator asks about it

Correct Answer: B. Disclose and manage it through controls such as recusal or independent review

Question 5

Which principle requires that monitoring collect no more information than is justified by its purpose?

A. Proportionality

B. Availability

C. Redundancy

D. Non-repudiation

Correct Answer: A. Proportionality

Question 6

Who should normally accept a significant business risk?

A. Any user who notices the risk

B. The person with authority over the affected objective and resources

C. Only the external auditor

D. The newest member of the security team

Correct Answer: B. The person with authority over the affected objective and resources

Question 7

Why is separation of duties used in security governance?

A. To ensure one person controls every stage of a process

B. To reduce the risk of error, fraud and self-approval

C. To eliminate the need for documentation

D. To prevent all operational decisions

Correct Answer: B. To reduce the risk of error, fraud and self-approval

Question 8

Which action best reflects responsible vulnerability disclosure?

A. Publishing sensitive records immediately

B. Selling the vulnerability to unrelated parties

C. Notifying an appropriate party with sufficient technical detail while limiting unnecessary access

D. Deleting all evidence of the vulnerability

Correct Answer: C. Notifying an appropriate party with sufficient technical detail while limiting unnecessary access

Question 9

What is a key limitation of treating compliance as the sole measure of security effectiveness?

A. Compliance always prevents every incident

B. A compliant control may still fail to manage the underlying risk effectively

C. Compliance makes policies unnecessary

D. Compliance removes the need for board oversight

Correct Answer: B. A compliant control may still fail to manage the underlying risk effectively

Question 10

An employee enters confidential organisational data into an unapproved generative-AI service. Which governance concern is most immediate?

A. Potential unauthorised disclosure of confidential information

B. Improved separation of duties

C. Reduced need for access control

D. Automatic achievement of regulatory compliance

Correct Answer: A. Potential unauthorised disclosure of confidential information