Information Security and Privacy Quick Reference

CHAPTER 2Governance, Risk Management, and Compliance

Policy serves as the foundation for any cybersecurity program, setting out the principles and rules that guide the execution of security efforts throughout the enterprise. Often, organizations base these policies on best practice frameworks developed by industry groups such as the National Institute of Standards and Technology (NIST) or the International Organization for Standardization (ISO). In many cases, organizational policies are also influenced and directed by external compliance obligations that regulators impose on the organization. In this chapter, you will learn about the important elements of the cybersecurity policy framework as well as the compliance obligations imposed on organizations by governments and other regulators.

The Role of Governance in Security and Privacy

Governance is a fundamental component of both security and privacy in any organization. It involves the collection of practices related to supporting, evaluating, defining, and directing an organization's security and privacy efforts. Effective governance ensures that an organization can protect its information assets while complying with relevant laws, regulations, and industry standards. This section explores the role of governance in security and privacy, highlighting key principles, frameworks, and practices that organizations should adopt.

Security Governance Principles

Security governance is the framework through which an organization ...