Information Security Risk, Governance and Compliance

Introduction and Context

Information security is not only a technical function. It is a management discipline concerned with protecting information assets while enabling an organisation to achieve its objectives, meet legal duties, maintain stakeholder trust and operate resiliently. Security decisions therefore involve competing considerations: confidentiality, integrity and availability; cost and risk reduction; privacy and business utility; innovation and control; and central oversight versus operational agility.

Risk, governance and compliance are related but distinct. Risk management determines what could harm organisational objectives and how that risk should be treated. Governance establishes authority, accountability, direction and oversight. Compliance demonstrates conformity with applicable laws, regulations, contracts, standards and internal policies. An organisation may be compliant yet insecure if controls satisfy a checklist but fail against realistic threats. Conversely, it may have effective controls but insufficient evidence to demonstrate compliance. Mature security programmes integrate all three perspectives.

Learning Objectives

By the end of this chapter, a learner should be able to:

1. Identify information-security assets, threats, vulnerabilities, risks and controls.
2. Analyse and prioritise risk using qualitative and quantitative methods.
3. Select, implement, monitor and accept risk treatments.
4. Explain the purposes and relationships of ISO/IEC 27001, the NIST Cybersecurity Framework and CIS Controls.
5. Design security policies and governance structures.
6. Prepare for audits and manage evidence, privacy duties and legal obligations.
7. Assess third-party risk, ethical responsibilities, awareness needs and management reporting.

1. The Language of Information-Security Risk

An asset is something valuable to an organisation, such as data, applications, infrastructure, services, people, reputation or intellectual property. A threat is a potential cause of an unwanted incident; examples include ransomware, fraud, an insider, equipment failure and natural hazards. A vulnerability is a weakness that a threat may exploit. An event is an occurrence that may be benign or harmful, while an incident is an event that actually or potentially compromises confidentiality, integrity or availability, or violates security policy.

A useful conceptual relationship is:

This is a conceptual model rather than a universal numerical law. It means that risk depends on the threat environment, weaknesses, exposure and consequences. The relationship is not necessarily linear: a highly capable threat may exploit a low-probability weakness, while a minor vulnerability in a critical system may produce severe consequences.

Inherent risk is the level before considering controls. Residual risk is the risk remaining after controls and treatments. Risk appetite is the broad amount and type of risk an organisation is willing to pursue or retain in achieving its objectives. Risk tolerance is the acceptable variation around an objective or risk threshold. Appetite is strategic; tolerance is usually more specific and operational.

The classic security objectives are:

• Confidentiality: information is accessible only to authorised entities.
• Integrity: information and systems remain accurate, complete and trustworthy.
• Availability: authorised users can access information and services when required.
• Authenticity: an entity or message is genuine.
• Accountability: actions can be attributed to responsible subjects.
• Non-repudiation: evidence supports the origin or receipt of an action so that it cannot credibly be denied.

These objectives can conflict. For example, extensive encryption may improve confidentiality but complicate availability during key-recovery failures. Security governance must therefore align controls with business requirements rather than maximise one property without context.

2. Risk Identification and Assessment

Risk identification begins with organisational context. The assessor should understand business processes, dependencies, legal requirements, information flows, critical services, interested parties and risk criteria. A practical risk register commonly records the asset or process, threat, vulnerability, existing controls, likelihood, impact, owner, treatment decision, target date and review status.

Useful identification techniques include interviews, workshops, process mapping, threat modelling, vulnerability assessment, incident analysis, penetration testing, supplier reviews and examination of audit findings. Threat modelling should consider abuse cases as well as technical defects. For example, a privileged administrator misusing a legitimate account may evade controls designed only for malware.

Qualitative analysis

Qualitative analysis uses categories such as low, medium, high and critical. A risk matrix combines likelihood and impact, but the organisation must define the categories consistently. A possible five-level scale is:

A simple matrix score can be calculated as:

where R is the risk score, L is the likelihood rating and I is the impact rating. Both are ordinal ratings, not necessarily measured probabilities or monetary values. Therefore, a score of 12 should not automatically be interpreted as exactly twice the risk of a score of 6. The organisation should define score bands and escalation rules before using the matrix.

Quantitative analysis

When reliable data exist, expected annual loss can support investment decisions:

where ALE is annualised loss expectancy, SLE is single-loss expectancy in currency units, and ARO is annual rate of occurrence. SLE may be estimated as asset value multiplied by exposure factor, but this requires defensible assumptions about the proportion of value lost in one event. ALE is an estimate, not a prediction, and should include uncertainty, ranges or sensitivity analysis where possible.

Worked example. A service outage is estimated to cost £40,000 per incident. Historical evidence and expert judgement suggest 0.25 such incidents per year. Then:

ALE = £40,000 × 0.25 = £10,000 per year.

A proposed control costing £6,000 per year may appear economically attractive if it reduces the expected loss by more than £6,000. However, the decision must also consider implementation risk, legal duties, safety, reputational effects, interdependencies and uncertainty. A purely financial comparison is inadequate where fundamental rights or public safety are involved.

Prioritisation

Risk prioritisation should consider more than score. High-priority risks commonly involve critical services, sensitive personal data, unsafe conditions, regulatory deadlines, active exploitation, concentrated dependencies or poor detectability. A risk owner—not necessarily the security team—should be accountable for deciding treatment because the owner controls the relevant business objective and resources.

3. Risk Treatment and Acceptance

Four standard treatment options are:

1. Avoid: stop the activity or redesign it so the risk no longer arises.
2. Reduce or modify: implement preventive, detective, corrective or compensating controls.
3. Share or transfer: allocate some consequences contractually or through insurance, while recognising that accountability cannot be fully outsourced.
4. Retain or accept: consciously continue with the risk when it is within approved tolerance.

Risk acceptance must be explicit, informed, time-bounded and authorised at the appropriate level. It should identify the risk, rationale, assumptions, residual exposure, compensating measures, expiry or review date and accountable approver. Silence, delayed remediation or lack of budget is not valid acceptance.

Controls can be administrative, technical or physical; preventive, detective or corrective; and directive, deterrent or compensatory. Examples include policy, training, least privilege, multifactor authentication, network segmentation, backups, logging, monitoring, incident response and physical access control. Control selection should address root causes and attack paths rather than merely produce a large inventory of controls.

Treatment effectiveness should be measured. Possible indicators include the percentage of critical assets covered by multifactor authentication, time to remediate critical vulnerabilities, restore-test success rate, proportion of suppliers assessed, and mean time to detect and contain incidents. Metrics need defined scope, data source, frequency, owner and decision threshold.

4. Major Security Frameworks and Standards

ISO/IEC 27001

ISO/IEC 27001 specifies requirements for an Information Security Management System (ISMS). Its central idea is a continual management system: establish context and leadership, assess risks, select treatments and controls, operate the system, evaluate performance and improve it. The standard supports certification of a defined scope; certification does not mean that an organisation is risk-free or that every product is secure.

An ISMS normally includes scope, information-security policy, risk methodology, risk treatment plan, applicable controls and their justification, documented information, competence, monitoring, internal audit, management review and corrective action. The Statement of Applicability records which controls are included or excluded and why. ISO/IEC 27001 is management-system oriented and can be integrated with quality, privacy and business-continuity systems.

NIST Cybersecurity Framework

The NIST Cybersecurity Framework 2.0 organises cybersecurity outcomes around Govern, Identify, Protect, Detect, Respond and Recover. Govern is a prominent coordinating function: it addresses organisational context, risk strategy, roles, policy, oversight and supply-chain risk. The framework is outcome-based rather than a prescriptive checklist. Organisations can create a Current Profile, define a Target Profile, analyse gaps and use Tiers to describe the sophistication and integration of risk-management practices.

CIS Controls

The CIS Critical Security Controls provide prioritised, practical safeguards. They emphasise inventory, secure configuration, account management, vulnerability management, audit logging, email and browser protections, malware defences, data recovery, network monitoring, application security, service-provider management, penetration testing and security awareness. CIS Implementation Groups help organisations select safeguards appropriate to their resources and risk.

These instruments are complementary. For example, an organisation may use ISO/IEC 27001 to govern its ISMS, NIST CSF to communicate its target state and CIS Controls to implement practical safeguards. Mappings should be treated as aids, not proof that equivalent requirements are automatically satisfied.

5. Security Governance and Policy

Governance allocates decision rights and ensures that management receives reliable information about risk. The board or governing body sets direction and oversight; executive leadership provides resources and accepts strategic exposure; a chief information security officer coordinates the programme; system and business owners manage operational risks; internal audit provides independent assurance; and users follow policies and report concerns.

A security steering committee can connect security, legal, privacy, procurement, technology, human resources, risk and business operations. Independence matters: those responsible for implementing controls should not be the sole judges of their effectiveness.

A policy hierarchy typically contains:

• Policy: mandatory principles and management intent.
• Standard: specific mandatory requirements, such as password or logging parameters.
• Procedure: ordered steps for performing a task.
• Guideline: recommended practice that permits professional judgement.
• Record or evidence: proof that an activity occurred.

Effective policies identify scope, responsibilities, exceptions, enforcement, review frequency and links to legal or contractual duties. They should be understandable and enforceable. A policy requiring security controls that the organisation cannot technically or operationally provide encourages routine non-compliance.

6. Audit, Assurance and Evidence

An audit is a systematic, independent and documented evaluation against defined criteria. Internal audits support improvement; external certification audits assess conformity to a standard; regulatory inspections investigate legal compliance; and customer audits assess contractual expectations. Audit is not the same as penetration testing: an audit evaluates criteria and evidence, while a penetration test evaluates exploitability within an agreed scope.

A sound audit programme defines scope, criteria, independence, competence, sampling, evidence handling, reporting and follow-up. Evidence should be relevant, reliable, sufficient and traceable. Examples include approved policies, access-review records, configuration reports, training completion, incident exercises, supplier assessments, backup restoration tests and management-review minutes. Screenshots without context may be weak evidence; exported records should preserve dates, scope and provenance.

Findings should distinguish nonconformity, observation, opportunity for improvement and risk. Corrective action should address root cause, not only the immediate symptom. Management should verify closure and assess whether similar weaknesses exist elsewhere.

7. Privacy, Legal Duties and Ethics

Privacy governance begins with lawful and transparent processing, purpose limitation, data minimisation, accuracy, retention control, security and respect for data-subject rights. Exact duties vary by jurisdiction and sector. Organisations must identify the laws, regulators, contractual commitments and cross-border requirements that apply to their operations; this chapter does not replace legal advice.

Security and privacy overlap but are not identical. Encryption can protect confidentiality, while privacy also concerns whether collection was justified, whether use matches the stated purpose, and whether individuals can exercise their rights. Privacy impact assessments are valuable where processing is high-risk, involves sensitive data, uses monitoring or introduces new technologies.

Legal and regulatory duties may include breach notification, records retention, sector-specific safeguards, electronic communications rules, intellectual-property protection, employment law, export restrictions and obligations to preserve evidence. Incident plans should define escalation to legal counsel, privacy officers, regulators, affected individuals, insurers and law enforcement where appropriate.

Ethical security practice requires proportionality, respect for autonomy, confidentiality, competence and avoidance of harm. Security professionals should obtain authorisation before testing, minimise data exposure, protect discovered weaknesses and disclose conflicts of interest. Surveillance, automated decision-making and employee monitoring require particular care because technically possible processing may still be unjust, discriminatory or excessive.

8. Third-Party and Supply-Chain Risk

Outsourcing a service does not outsource accountability. Before engagement, organisations should classify supplier criticality, data access, connectivity, geographic exposure, concentration risk and substitutability. Due diligence may include security questionnaires, independent assurance reports, certifications, penetration-test summaries, financial viability checks and references.

Contracts should address security requirements, subcontractors, access control, encryption, logging, incident notification, cooperation, audit rights, data location, retention and deletion, vulnerability handling, business continuity, recovery objectives and termination assistance. Requirements must be measurable; “industry-standard security” alone is often too vague.

Ongoing assurance includes risk-based reassessment, review of incidents and performance indicators, access recertification and testing of exit plans. Cloud shared-responsibility models must be documented clearly: the provider may secure infrastructure while the customer remains responsible for identities, configurations, data and many compliance decisions.

9. Awareness, Culture and Management Reporting

Awareness is more than annual compliance training. A mature programme provides role-based learning for executives, developers, administrators, procurement staff and general users; reinforces secure behaviour through exercises and usable tools; and measures reporting quality rather than blaming people for every mistake. Simulated phishing can be useful when conducted ethically, with privacy safeguards and educational follow-up.

Management reporting should connect security activity to organisational outcomes. A useful report explains risk movement, material incidents, control effectiveness, exceptions, overdue actions, supplier exposure, resilience and decisions required. Metrics should avoid vanity measures such as training attendance alone. Leading indicators may include patch coverage, privileged-access review completion and exercise participation; lagging indicators may include incidents, losses, recovery time and audit findings.

A dashboard should show trends, thresholds and confidence in the data. A red metric without an owner or decision is merely decoration. Reports should be tailored: the board needs strategic exposure and decisions, while technical teams need actionable control data.

10. Applied Case: Northbridge Health Services

The following is a fictional illustrative case.

Background

Northbridge Health Services operates clinics and a patient portal. It stores medical records, payment data and employee information. A small security team supports a hybrid environment containing cloud services, legacy clinical systems and connected diagnostic devices.

Problem

A supplier’s compromised account was used to access a portal administration function. The account lacked multifactor authentication, logging was incomplete and the supplier contract had no clear incident-notification deadline. The organisation contained the activity after unusual data queries were detected, but it could not initially determine the full scope.

Analysis

The incident exposed several linked risks: excessive third-party privilege, weak identity assurance, insufficient monitoring, uncertain breach obligations and inadequate supplier governance. A qualitative assessment rated the risk high because the data were sensitive, the supplier connection was material and impact could include patient harm, regulatory action and loss of trust. The risk owner was the clinical-services executive, supported by information security, privacy, procurement and the supplier manager.

The team mapped the problem to the NIST functions: Govern (supplier accountability and policy), Identify (data flows and critical accounts), Protect (multifactor authentication and least privilege), Detect (central logging and alerting), Respond (notification and investigation procedures) and Recover (credential rotation and service restoration). ISO/IEC 27001 processes were used to update the risk register, treatment plan, Statement of Applicability evidence and management review. CIS safeguards informed practical tasks such as inventory, account management, logging and service-provider management.

Approach and solution

Northbridge immediately disabled the affected account, preserved evidence, rotated credentials and engaged legal and privacy advisers. It then required multifactor authentication for all supplier access, introduced just-in-time privileged access, restricted administration to approved locations, centralised relevant logs and tested detection rules. The contract was amended to include minimum controls, rapid notification, cooperation, subcontractor disclosure, audit evidence and secure termination.

A tabletop exercise tested communications among the supplier, incident response team, clinical leadership and privacy office. Management accepted a temporary residual risk for one legacy device population because immediate replacement was unsafe; the acceptance had an executive approver, compensating network isolation, monitoring and a fixed review date.

Outcome

The organisation improved visibility and reduced standing privilege. It also discovered that a purely technical remediation would have been insufficient: unclear ownership, contract weakness and incomplete legal escalation had contributed materially to exposure. The case demonstrates why governance and compliance must be integrated with engineering controls.

Learning points

1. Third-party access is part of the organisation’s attack surface.
2. Risk ownership must sit with a business authority able to make trade-offs.
3. Framework mapping is useful only when it produces implemented and evidenced action.
4. Risk acceptance must be explicit and temporary where possible.
5. Privacy, legal, clinical and security decisions should be coordinated early.

11. Challenges and Contemporary Developments

Organisations face rapidly changing cloud architectures, ransomware, software supply-chain compromise, artificial intelligence, identity attacks and geopolitical threats. Artificial intelligence can assist with control monitoring, anomaly triage, policy analysis and reporting, but it introduces risks of inaccurate outputs, data leakage, prompt manipulation, discriminatory decisions and unclear accountability. AI systems should be governed through defined use cases, approved data, human oversight, access restrictions, testing, logging and incident procedures.

A further challenge is control overload. More controls do not automatically produce more security. Organisations should prioritise high-value attack paths, validate effectiveness through testing and remove obsolete requirements. They should also avoid treating certification as an end state. Continuous improvement requires learning from incidents, exercises, near misses, changes in technology and changes in the threat environment.

Best-Practice Principles

• Align security risk with business and societal consequences.
• Define scope, ownership, criteria and evidence before assessment.
• Use frameworks as complementary tools, not competing checklists.
• Apply least privilege, secure configuration, resilience and defence in depth.
• Make exceptions visible, approved, time-limited and reviewed.
• Integrate privacy and legal expertise into design and incident response.
• Treat suppliers and cloud services as part of the operational environment.
• Measure outcomes, trends and control effectiveness rather than activity alone.
• Build a just culture in which people report mistakes and suspicious events promptly.
• Reassess risk whenever systems, suppliers, laws or threats materially change.

Chapter Summary

Information-security risk management identifies threats and vulnerabilities, estimates likelihood and impact, prioritises exposure and selects proportionate treatment. Residual risk must be owned and accepted explicitly by an authorised decision-maker. ISO/IEC 27001 provides an auditable ISMS structure; NIST CSF 2.0 communicates cybersecurity outcomes through Govern, Identify, Protect, Detect, Respond and Recover; and CIS Controls provide prioritised practical safeguards. Governance establishes accountability, policies translate intent into requirements, and audits provide independent evidence-based assurance. Privacy and legal duties extend beyond technical confidentiality to lawful purpose, minimisation, transparency and rights. Third-party risk, awareness, ethical conduct, AI governance and management reporting are essential parts of a strategic security programme. Effective security is therefore a continual, risk-informed management process rather than a one-time compliance exercise.

Key Terms

Asset: Something valuable that requires protection.

Threat: A potential cause of a harmful security event.

Vulnerability: A weakness that a threat may exploit.

Risk: The effect of uncertainty on objectives, including potential security harm.

Inherent risk: Risk before considering controls.

Residual risk: Risk remaining after controls or treatment.

Risk appetite: The type and amount of risk an organisation is willing to pursue or retain.

Risk owner: The person accountable for managing a defined risk.

Risk treatment: Action taken to avoid, reduce, share or retain risk.

Control: A measure that modifies risk.

ISMS: Information Security Management System.

Statement of Applicability: A documented justification of applicable and excluded security controls in an ISMS.

NIST CSF: A framework for organising cybersecurity outcomes and practices.

CIS Controls: Prioritised safeguards for improving cybersecurity.

Audit: Independent, systematic evaluation against defined criteria.

Compliance: Conformity with applicable obligations or requirements.

Privacy: Governance of personal information and individual rights.

Third-party risk: Risk arising from suppliers, partners or service providers.

Residual risk acceptance: Explicit authorised approval to retain remaining exposure.

Security awareness: Knowledge and behaviour programmes supporting secure practice.

Review Questions

5 Short Answer Questions

1. Distinguish between a threat, vulnerability and risk.
2. What is the difference between risk appetite and risk tolerance?
3. State the four common risk-treatment options.
4. What is the purpose of a Statement of Applicability?
5. Why does supplier outsourcing not eliminate organisational accountability?

5 Long Answer Questions

1. Explain how an organisation can combine ISO/IEC 27001, NIST CSF and CIS Controls in one security programme.
2. Discuss the strengths and limitations of qualitative risk matrices and quantitative annualised loss expectancy.
3. Explain how governance, policy, audit and management reporting interact.
4. Analyse the relationship between information security and privacy obligations.
5. Describe a risk-based third-party assurance lifecycle from due diligence to termination.

3 Analytical / Application Questions

1. A hospital discovers that a high-privilege supplier account has no multifactor authentication and that logs are incomplete. Identify the risks, propose treatments and specify what evidence management should require.
2. An organisation receives a critical audit finding but has insufficient funds to remediate it immediately. Develop a defensible interim treatment and risk-acceptance decision.
3. Design a concise board dashboard containing five indicators that would show whether a cybersecurity programme is reducing material organisational risk. Justify each indicator.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes residual risk from inherent risk?

A. Residual risk exists before any controls are applied.

B. Residual risk is the risk remaining after controls and treatment.

C. Residual risk is always zero after certification.

D. Residual risk applies only to suppliers.

Correct Answer: B. Residual risk is the risk remaining after controls and treatment.

Question 2

In the simple qualitative model R = L × I, what do L and I represent?

A. Log level and incident count

B. Loss and insurance

C. Likelihood and impact ratings

D. Legal duty and integrity

Correct Answer: C. Likelihood and impact ratings

Question 3

Which NIST Cybersecurity Framework function addresses organisational context, risk strategy and oversight?

A. Govern

B. Protect

C. Detect

D. Recover

Correct Answer: A. Govern

Question 4

What is the principal purpose of ISO/IEC 27001?

A. To provide a malware signature database

B. To specify requirements for an Information Security Management System

C. To replace all privacy legislation

D. To prescribe one network architecture

Correct Answer: B. To specify requirements for an Information Security Management System

Question 5

Which option is an example of risk avoidance?

A. Installing additional monitoring for an existing service

B. Buying insurance for a data-centre outage

C. Accepting the risk without documentation

D. Discontinuing a high-risk service that is not required

Correct Answer: D. Discontinuing a high-risk service that is not required

Question 6

Why is a risk matrix score not necessarily a ratio-scale measurement?

A. Its ratings are often ordinal categories rather than measured probabilities.

B. It can only be used for financial risks.

C. It requires no defined criteria.

D. Impact cannot be considered in a matrix.

Correct Answer: A. Its ratings are often ordinal categories rather than measured probabilities.

Question 7

Which evidence would most directly demonstrate that backup recoverability has been tested?

A. A security awareness poster

B. A supplier marketing brochure

C. A dated restoration-test record showing results and scope

D. An unsigned draft policy

Correct Answer: C. A dated restoration-test record showing results and scope

Question 8

Which statement about third-party risk is most accurate?

A. A contract transfers all security accountability to the supplier.

B. Supplier risk matters only when personal data are processed.

C. Outsourcing can remove the need for access reviews.

D. The organisation remains accountable for risks arising from outsourced services.

Correct Answer: D. The organisation remains accountable for risks arising from outsourced services.

Question 9

What is the main purpose of explicit risk acceptance?

A. To hide unresolved audit findings

B. To document an informed, authorised decision to retain residual exposure

C. To guarantee that an incident cannot occur

D. To eliminate the need for controls

Correct Answer: B. To document an informed, authorised decision to retain residual exposure

Question 10

An incident costs £40,000 per occurrence and is expected 0.25 times per year. What is the ALE?

A. £1,000

B. £10,000

C. £40,000

D. £160,000

Correct Answer: B. £10,000