Managing Information Security Risk: Organization, Mission, and Information System View
CHAPTER TWO > 2.3 TIER ONE—ORGANIZATION VIEW > 2.3.1 Governance

2.3.1 Governance

In general, governance is the set of responsibilities and practices exercised by those responsible
for an organization (e.g., the board of directors and executive management in a corporation, the
head of a federal agency) with the express goal of: (i) providing strategic direction; (ii) ensuring
that organizational mission and business objectives are achieved; (iii) ascertaining that risks are
managed appropriately; and (iv) verifying that the organization's resources are used responsibly.21
Risks and resources can be associated with different organizational sectors (e.g., legal, finance,
information technology, regulatory compliance, information security). Different sectors require
specialized expertise in order to manage the risks associated with that sector. Thus, governance
within organizations frequently is organized by sector.22 The five outcomes of governance related
to organization-wide risk management are:
21 This definition is adapted from the IT Governance Institute. The Chartered Institute of Management Accountants and
the International Federation of Accountants also adopted this definition in 2004.
22 While governance is frequently organized by sectors, organizations are well served by establishing a single aligned
governance approach. A unified governance approach can coordinate the individual sector governance activities and
provide a consistent governance approach, organization-wide.
• Strategic alignment of risk management decisions with missions and business functions
consistent with organizational goals and objectives;
• Execution of risk management processes to frame, assess, respond to, and monitor risk to
organizational operations and assets, individuals, other organizations, and the Nation;
• Effective and efficient allocation of risk management resources;
• Performance-based outcomes by measuring, monitoring, and reporting risk management
metrics to ensure that organizational goals and objectives are achieved; and
• Delivered value by optimizing risk management investments in support of organizational
objectives.23
As part of organizational governance, senior leaders/executives in consultation and collaboration
with the risk executive (function), determine: (i) the types of risk management decisions that are
reserved for specific senior leadership roles (e.g., heads of agencies or chief executive officers,
chief financial officers, chief information officers, chief information security officers);24 (ii) the
types of risk management decisions that are deemed to be organization-wide and the types of
decisions that can be delegated to subordinate organizations or to other roles in the organization
(e.g., systems and security engineers, mission/business owners, enterprise architects, information
security architects, common infrastructure or service providers, authorizing officials); and (iii)
how risk management decisions will be communicated to and by the risk executive (function).
Three different types of governance models (i.e., centralized, decentralized, and hybrid) are
described in Appendix F. Regardless of the governance model(s) employed, clear assignment and
accountability for accepting risk is essential for effective risk management.
Strong governance is the best indicator of senior leadership commitment to effective, consistent risk
management across the organization to achieve ongoing mission/business success.