Security Governance, Standards and Compliance

Introduction

Cybersecurity is not governed effectively by technology alone. Firewalls, endpoint protection, identity systems and security monitoring are valuable controls, but their value depends on decisions about authority, accountability, risk acceptance, information ownership, legal duties and business priorities. Security governance provides the structure through which an organisation directs and controls cybersecurity. It connects organisational objectives with policies, risk decisions, controls, assurance and continual improvement.

Governance is broader than security management. Management plans and operates security activities; governance establishes direction, approves priorities, assigns accountability and evaluates whether security outcomes support the organisation’s objectives. Compliance is also related but distinct. Compliance demonstrates that specified legal, regulatory, contractual or internal requirements have been addressed. An organisation may be compliant yet poorly protected against emerging threats, while an organisation may have strong security practices but fail a statutory reporting obligation.

This chapter examines governance structures, security policies, roles and accountability, and four influential frameworks: the NIST Cybersecurity Framework, ISO/IEC 27001, the CIS Controls and COBIT. It also relates operational security to privacy, cybercrime, digital evidence, regulatory obligations and contracts.

Learning Objectives

By the end of this chapter, the learner should be able to:

1. Distinguish cybersecurity governance, management, risk and compliance.
2. Design a policy hierarchy and assign security roles and accountability.
3. Compare and appropriately use NIST CSF 2.0, ISO/IEC 27001:2022, CIS Controls v8.1 and COBIT 2019.
4. Map operational controls to privacy, cybercrime, evidence, regulatory and contractual obligations.
5. Evaluate governance weaknesses and recommend proportionate improvements.
6. Explain how assurance, metrics and continual improvement support accountable security.

Governance, Management and Accountability

Governance and management

Governance answers questions such as:

• What level of cyber risk is acceptable?
• Which information and services are most important?
• Who may accept residual risk?
• What resources should be allocated to security?
• How will the board know whether security is effective?

Management converts these decisions into plans, procedures and operational activities. For example, a board may require that critical services remain available during a ransomware incident. Security management then implements backup, segmentation, recovery testing, monitoring and incident response processes.

A useful distinction is:

Accountability and responsibility

Responsibility means performing an assigned activity. Accountability means being answerable for its outcome. A system administrator may be responsible for applying patches, while the infrastructure manager is accountable for ensuring that patching is adequately governed and reported. Accountability should not be transferred merely by delegating a task.

The RACI model is often used to clarify ownership:

• Responsible: performs the work.
• Accountable: owns the result and approves the outcome.
• Consulted: provides expertise before a decision.
• Informed: receives relevant information after or during the activity.

Each important control should have an accountable owner. “The IT department” is usually too vague; a named role such as Chief Information Security Officer, system owner or data owner is more effective.

The three lines model

A practical governance structure may use three lines:

1. First line—operations: owns risks and operates controls, such as access administration, secure development and backup management.
2. Second line—risk and compliance: establishes methods, advises operations, monitors adherence and coordinates risk reporting.
3. Third line—internal audit: independently evaluates governance, risk management and control effectiveness.

External auditors, regulators and certification bodies provide additional external assurance, but they do not replace management accountability.

Security Policy Architecture

A policy is an approved statement of organisational intent. It should not be confused with a technical configuration or a detailed work instruction. A mature policy architecture normally contains several layers:

1. Enterprise security policy: establishes principles, scope, authority and management commitment.
2. Topic-specific policies: address acceptable use, identity and access management, data classification, remote work, cryptography, incident response and third-party security.
3. Standards: specify mandatory technical or procedural requirements, such as minimum passwordless authentication coverage or approved encryption protocols.
4. Procedures: describe how a task is performed.
5. Guidelines: provide recommended but non-mandatory advice.
6. Records and evidence: demonstrate that activities occurred, such as access reviews, training records and incident logs.

Effective policies define purpose, scope, roles, mandatory requirements, exceptions, enforcement, review frequency and ownership. They should be understandable to their audience and aligned with actual capability. A policy requiring immediate critical patching is ineffective if no process, staffing or maintenance window exists to achieve it.

Policies also require lifecycle control. A policy owner should review it when legislation changes, a major incident occurs, technology changes or the scheduled review date arrives. Exceptions should be documented, time-limited, risk-assessed and approved by an authorised person. Permanent informal exceptions are usually unmanaged risk.

Risk, Control and Assurance

Security governance is risk-based. Risk can be described conceptually as the possibility that threats exploit vulnerabilities and produce adverse consequences. A simple qualitative model considers likelihood and impact; it is not a universal numerical law. Quantitative estimates may be used where credible data exists, but false precision should be avoided.

A risk statement should identify:

• the asset, process or objective at risk;
• the threat or event;
• the vulnerability or condition enabling it;
• the consequence; and
• existing controls and residual exposure.

For example: “A compromised privileged account could alter the payment database, causing financial loss and regulatory reporting obligations; current controls include multifactor authentication and privileged-access logging.”

Controls may be preventive, detective, corrective, deterrent or compensating. Multifactor authentication is primarily preventive; an alert for impossible travel is detective; restoration from tested backups is corrective. A control is not automatically effective because it exists. Effectiveness requires suitable design, correct implementation and consistent operation.

Assurance evidence should be proportionate and reliable. Examples include configuration exports, access review approvals, vulnerability reports, incident records, restoration-test results, training completion and independent audit observations. Screenshots alone may show a moment in time but not sustained operation.

Major Cybersecurity Frameworks and Standards

Frameworks organise security knowledge and support communication. They are not interchangeable checklists. Their purposes, structures and assurance models differ.

NIST Cybersecurity Framework 2.0

NIST CSF 2.0 is a voluntary framework for managing cybersecurity risk. Its six functions are:

• Govern: establish and monitor the organisation’s cybersecurity risk management strategy, expectations and policy.
• Identify: understand assets, risks, suppliers and improvement needs.
• Protect: implement safeguards for delivery of critical services.
• Detect: discover and analyse possible cybersecurity attacks and compromises.
• Respond: take action regarding a detected incident.
• Recover: restore affected assets and operations and communicate recovery activities.

The addition of Govern emphasises that cybersecurity is an organisational risk and leadership responsibility, not only a technical function. CSF Categories and Subcategories provide more detailed outcomes. Organisations can create Current Profiles describing present outcomes and Target Profiles describing desired outcomes. The gap between them supports prioritisation.

NIST CSF is outcome-oriented and flexible. It does not prescribe one technology or require certification. It is useful for executive communication, maturity discussions, programme planning and mapping to other standards.

ISO/IEC 27001:2022

ISO/IEC 27001 specifies requirements for establishing, implementing, maintaining and continually improving an Information Security Management System (ISMS). An ISMS is a management system, not merely a collection of technical controls. It requires consideration of organisational context, interested parties, scope, leadership, planning, support, operation, performance evaluation and improvement.

Risk assessment and treatment are central. The organisation determines applicable controls and records justification in a Statement of Applicability. Annex A provides a reference set of controls, organised in the 2022 edition into organisational, people, physical and technological themes. The organisation may use additional controls when its risk assessment requires them.

ISO/IEC 27001 supports independent certification by an accredited certification body, subject to the relevant certification process. Certification applies to a defined scope; it does not mean that every system or supplier worldwide is secure, nor does it guarantee immunity from attack. ISO/IEC 27002 provides guidance on information security controls but is not itself the certification standard.

CIS Controls v8.1

The CIS Critical Security Controls are prioritised safeguards intended to reduce common cyberattack risks. They are operationally concrete and useful for organisations that need to establish or improve basic security capability. Examples include asset inventory, software inventory, data protection, secure configuration, account management, vulnerability management, audit logging, email and browser protection, malware defences, data recovery and incident response.

Implementation Groups help organisations select safeguards according to resources, threat exposure and sensitivity. CIS Controls are especially useful for translating governance goals into practical technical and administrative actions. Their limitation is that they do not replace a complete legal, privacy, enterprise-risk or governance system.

COBIT 2019

COBIT is an enterprise governance and management framework for information and technology. It distinguishes governance from management:

• Evaluate, Direct and Monitor (EDM): governance activities performed by the governing body.
• Align, Plan and Organize (APO): strategic alignment and planning.
• Build, Acquire and Implement (BAI): development and implementation.
• Deliver, Service and Support (DSS): operational delivery and support.
• Monitor, Evaluate and Assess (MEA): performance, internal control and compliance assessment.

COBIT is valuable for connecting technology objectives to enterprise goals, decision rights, processes, performance measures and assurance. It is not a technical control catalogue in the same sense as the CIS Controls. It helps answer who should decide, how processes should be governed and how value and risk should be evaluated.

Comparative use

They can be combined. For example, COBIT may define governance and process accountability; ISO/IEC 27001 may provide the management-system structure; NIST CSF may communicate the target cybersecurity outcomes; and CIS Controls may guide implementation priorities.

Privacy, Cybercrime and Digital Evidence

Privacy governance

Privacy and security overlap but are not identical. Security protects confidentiality, integrity and availability; privacy governs the lawful and fair handling of personal information, including collection, use, sharing, retention and individual rights. Security controls should therefore be selected with privacy consequences in mind.

Important privacy governance practices include data inventories, purpose limitation, data minimisation, retention schedules, access controls, privacy impact assessments, processor management and breach response. Logging can improve accountability but may itself contain personal information. Organisations should define log access, retention, lawful purpose and protection against unauthorised disclosure.

Privacy requirements vary by jurisdiction. A responsible programme identifies applicable laws and sector rules rather than assuming that one framework satisfies every jurisdiction. Legal counsel and privacy specialists should interpret specific duties such as breach notification deadlines and cross-border transfer requirements.

Cybercrime and cooperation

Cybercrime investigations may involve unauthorised access, fraud, extortion, identity misuse, malware distribution or unlawful interception. Security teams should preserve relevant information without exceeding their authority. Monitoring must have a defined purpose, legal basis where required, appropriate notice and controlled access.

Organisations should establish contacts and procedures for internal investigation, legal counsel, law enforcement, regulators, insurers and affected partners. Evidence handling must respect jurisdiction, authorisation and confidentiality. Employees should not conduct uncontrolled “hack back” activities; counterattacking may be unlawful and can damage evidence or affect innocent systems.

Digital evidence and chain of custody

Digital evidence is fragile and can be altered by normal system operation. A defensible process records who collected evidence, what was collected, when and how it was collected, where it was stored, who accessed it and why. Hashes can help demonstrate that a file or forensic image has not changed after acquisition, but a matching hash does not by itself prove that the original acquisition process was lawful or complete.

Evidence procedures should address time synchronisation, volatile data, write protection, forensic imaging, access controls, retention, legal holds and secure disposal. Incident responders should distinguish facts, interpretations and hypotheses in their notes. The objective is not merely to collect the largest volume of data; it is to preserve reliable, relevant and admissible information.

Regulatory and Contractual Compliance

Compliance obligations arise from several sources:

• legislation and regulations;
• sector requirements, such as financial or health information rules;
• regulator guidance and directions;
• contracts with customers and suppliers;
• insurance conditions;
• professional and internal standards; and
• certification commitments.

A compliance register should identify each obligation, its owner, affected systems, required controls, evidence, reporting duties and review date. Contract review is particularly important. Customer agreements may specify encryption, incident notification, audit rights, data location, subcontractor approval, deletion on termination and recovery objectives.

A useful control-to-obligation matrix links requirements to controls and evidence. One control may satisfy multiple obligations, but the organisation must verify that its scope, timing and evidence meet each obligation. For example, an annual access review may not satisfy a requirement for prompt removal of access after termination.

Third-party risk is a governance responsibility. Due diligence, security clauses, right-to-audit provisions, breach notification terms, subcontractor controls, service-level expectations and exit arrangements should be proportionate to the supplier’s access and criticality. A vendor certificate should support, not replace, risk assessment.

Metrics, Reporting and Continual Improvement

Boards need concise information that supports decisions rather than technical volume. Useful reporting may include:

• number and severity of overdue critical vulnerabilities;
• percentage of critical assets inventoried;
• privileged-account review completion;
• phishing-resistant authentication coverage;
• backup restoration-test success;
• incident detection and containment trends;
• supplier assessment status; and
• overdue risk acceptances.

Metrics require definitions and context. “Number of incidents” may increase because detection improved, not because security deteriorated. Leading indicators, such as coverage of tested backups, should be combined with lagging indicators, such as realised incidents. Metrics should identify trends, thresholds, ownership and decisions required.

Continual improvement follows a cycle: establish context and objectives, assess risk, implement controls, measure performance, investigate weaknesses, improve controls and reassess. Findings should be prioritised according to risk, not merely the age or quantity of audit observations.

Applied Case: Northbridge Health Services

The following is an illustrative case.

Background

Northbridge Health Services operates clinics and a cloud-based patient appointment platform. It processes medical and identity information and relies on several external providers. The organisation has antivirus software, annual staff training and an incident response document, but no formal security governance committee.

Problem

A stolen administrator password is used to access a cloud management console. The attacker creates a new account, downloads patient records and deploys ransomware against a file service. Northbridge discovers that some logs are unavailable because retention settings were inconsistent. A supplier contract requires notification within 24 hours, while applicable privacy law may require notification to the regulator within a defined statutory period after assessment.

Analysis

Governance weaknesses include unclear ownership of cloud security, inadequate privileged-access controls, incomplete asset and data inventories, weak supplier oversight and no tested decision process for notification. The incident also demonstrates that confidentiality and availability risks can occur together.

The organisation maps the problem as follows:

• NIST CSF: Govern and Identify expose ownership and inventory gaps; Protect highlights identity and backup controls; Detect highlights logging; Respond and Recover highlight communications and restoration.
• ISO/IEC 27001: the ISMS scope must include the cloud platform and relevant suppliers; risk treatment and evidence need formal ownership.
• CIS Controls: account management, data protection, audit logging, vulnerability management, data recovery and incident response are immediate priorities.
• COBIT: EDM clarifies board oversight; APO addresses risk and supplier planning; DSS supports incident and service operations; MEA supports assurance.

Approach and solution

Northbridge establishes a security steering committee chaired by an executive risk owner. The data protection officer, technology leader, clinical representative, legal adviser and supplier manager participate. The committee approves risk appetite and receives monthly reporting.

The organisation then:

1. defines the ISMS and cloud-service scope;
2. inventories critical services, data and suppliers;
3. enforces phishing-resistant multifactor authentication for privileged access;
4. removes standing administrative privileges where feasible;
5. centralises and protects security logs with tested retention;
6. classifies patient data and applies least-privilege access;
7. tests immutable backups and restoration procedures;
8. updates contracts with notification, evidence and subcontractor requirements;
9. rehearses incident escalation with legal, privacy, clinical and communications teams; and
10. conducts an independent review after remediation.

Outcome

Northbridge reduces the likelihood of credential-based compromise and improves its ability to detect, contain and recover from incidents. It also produces evidence for customers, regulators and auditors. The organisation does not claim that certification eliminates risk; instead, it uses governance and assurance to demonstrate controlled, continually improving risk management.

Learning points

The case illustrates that governance failures often become operational failures. Clear authority, reliable inventories, protected evidence, tested recovery and coordinated legal decision-making are as important as individual security technologies.

Challenges and Limitations

Framework adoption can fail when it becomes a documentation exercise. A large policy library does not prove effective control operation. Mapping every framework statement to every control may create administrative burden without reducing risk. Organisations should select a manageable scope, prioritise material risks and test whether controls work in practice.

Frameworks also contain general language that requires professional judgement. They do not automatically resolve conflicting laws, define an organisation’s risk appetite or determine whether evidence is admissible in a particular court. Certification has scope limitations, audits are sample-based, and self-assessments may suffer from bias.

Small organisations face resource constraints, while large organisations face fragmentation and unclear ownership. Cloud and software supply chains complicate boundaries: an organisation remains accountable for its own decisions even when a provider operates the underlying infrastructure. Artificial intelligence introduces additional governance issues, including data provenance, model access, prompt leakage, excessive autonomy, monitoring and vendor accountability. AI security should be integrated into existing risk and control processes rather than treated as a separate slogan.

Best-Practice Guidance

A mature governance programme should:

1. obtain visible executive sponsorship;
2. define scope, critical services, information owners and risk appetite;
3. assign one accountable owner to each material risk and control;
4. maintain a current obligation and supplier register;
5. combine a governance framework with practical safeguards;
6. protect and test logs, backups and evidence processes;
7. use metrics that support decisions and show trends;
8. rehearse incident, privacy and business-continuity decisions;
9. review exceptions and risk acceptances by expiry date; and
10. improve controls using incidents, exercises, audits and changing threats.

Chapter Summary

Cybersecurity governance establishes direction, authority, accountability and assurance, while management implements and operates security controls. Effective governance requires a clear policy hierarchy, named owners, risk-based decisions, independent assurance and reliable evidence.

NIST CSF 2.0 organises cybersecurity outcomes through Govern, Identify, Protect, Detect, Respond and Recover. ISO/IEC 27001:2022 provides requirements for a certifiable information-security management system. CIS Controls v8.1 offers prioritised operational safeguards, and COBIT 2019 connects information and technology activities to enterprise governance, value and accountability. These resources are complementary rather than interchangeable.

Security operations must also address privacy, cybercrime, digital evidence, regulatory duties and contract requirements. Governance should therefore include data inventories, lawful monitoring, chain-of-custody procedures, obligation registers, supplier controls, incident notification processes and tested recovery. Frameworks support disciplined improvement, but they do not guarantee security; effective outcomes depend on leadership, resources, competent implementation and continual evaluation.

Key Terms

Governance: Direction, oversight and accountability for achieving organisational objectives.

Security management: Planning and operating activities that implement security decisions.

Accountability: Being answerable for an outcome or decision.

Responsibility: Performing an assigned task or activity.

Risk appetite: The level and type of risk an organisation is willing to pursue or retain.

Residual risk: Risk remaining after controls are applied.

Control: A measure that modifies risk.

Assurance: Evidence-based confidence that governance and controls are suitable and effective.

RACI: A responsibility model identifying Responsible, Accountable, Consulted and Informed roles.

ISMS: Information Security Management System.

Statement of Applicability: An ISO/IEC 27001 record explaining control applicability and justification.

NIST CSF: A framework for organising cybersecurity risk-management outcomes.

CIS Controls: Prioritised safeguards for reducing common cyber risks.

COBIT: A framework for governance and management of enterprise information and technology.

Privacy: Governance of the lawful, fair and appropriate handling of personal information.

Digital evidence: Information with potential value in investigating or proving an event.

Chain of custody: A documented history of evidence collection, handling, access and storage.

Compliance register: A maintained record of applicable obligations, owners, controls and evidence.

Risk acceptance: A formally authorised decision to retain a known risk.

Third-party risk: Risk arising from suppliers, partners or service providers.

Review Questions

Short Answer Questions

1. Distinguish cybersecurity governance from security management.
2. What is the difference between responsibility and accountability?
3. Name the six functions of NIST CSF 2.0.
4. What is the purpose of an ISO/IEC 27001 Statement of Applicability?
5. Why should digital evidence have a documented chain of custody?

Long Answer Questions

1. Explain how a policy hierarchy supports effective security governance.
2. Compare NIST CSF 2.0, ISO/IEC 27001:2022, CIS Controls v8.1 and COBIT 2019.
3. Discuss how privacy obligations affect security logging and incident response.
4. Explain the role of contracts and supplier governance in cybersecurity.
5. Describe how a board-level security report can combine leading and lagging indicators.

Analytical / Application Questions

1. A university has strong endpoint protection but no asset inventory, unclear system ownership and untested backups. Use NIST CSF and CIS Controls to prioritise a six-month improvement plan.
2. A cloud supplier refuses to provide detailed security logs after a suspected breach. Analyse the governance, contractual, privacy and evidence issues and recommend actions.
3. Design a RACI assignment for incident response involving the CISO, system owner, privacy officer, legal counsel, communications manager and external provider. Justify the accountable role for each major decision.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes governance from management?

A. Governance operates firewalls, while management writes laws.

B. Governance sets direction and accountability, while management implements and operates activities.

C. Governance is performed only by external auditors.

D. Management accepts all organisational risk without oversight.

Correct Answer: B. Governance sets direction and accountability, while management implements and operates activities.

Question 2

Which NIST CSF 2.0 function focuses on organisational cybersecurity strategy, expectations and policy?

A. Govern

B. Protect

C. Detect

D. Recover

Correct Answer: A. Govern

Question 3

What is the primary purpose of an ISO/IEC 27001 Statement of Applicability?

A. To list every cybercrime committed against an organisation

B. To document why relevant controls are included or excluded

C. To replace the organisation’s risk assessment

D. To certify every supplier automatically

Correct Answer: B. To document why relevant controls are included or excluded

Question 4

Which framework is most directly focused on prioritised operational safeguards against common attacks?

A. COBIT 2019

B. ISO/IEC 27001

C. CIS Controls

D. NIST Privacy Framework only

Correct Answer: C. CIS Controls

Question 5

In a RACI model, who is answerable for the outcome?

A. Responsible

B. Accountable

C. Consulted

D. Informed

Correct Answer: B. Accountable

Question 6

Which practice best supports the integrity of digital evidence?

A. Allowing all responders to edit the original files

B. Deleting logs after an incident review

C. Recording collection, handling, access and storage history

D. Relying only on an employee’s memory

Correct Answer: C. Recording collection, handling, access and storage history

Question 7

Which statement about ISO/IEC 27001 certification is correct?

A. It guarantees that the organisation cannot be breached.

B. It applies to a defined scope and demonstrates conformity with specified requirements.

C. It replaces all privacy-law obligations.

D. It proves that every supplier is secure.

Correct Answer: B. It applies to a defined scope and demonstrates conformity with specified requirements.

Question 8

A control that restores systems from tested backups after ransomware is primarily what type of control?

A. Corrective

B. Deterrent

C. Preventive

D. Directive

Correct Answer: A. Corrective

Question 9

Which COBIT objective domain includes Evaluate, Direct and Monitor?

A. EDM

B. APO

C. BAI

D. DSS

Correct Answer: A. EDM

Question 10

Why should security metrics include context and trends?

A. Because a higher incident count always proves weaker security

B. Because metrics without definitions may misrepresent performance or improvement

C. Because metrics eliminate the need for risk assessment

D. Because technical volume is the only board concern

Correct Answer: B. Because metrics without definitions may misrepresent performance or improvement