Security Policies and Implementation Issues, 3rd Edition

Roles, Responsibilities, and Accountability for Personnel

It’s important to understand the relationship between individuals and organizational roles and committees. Many IT processes pass through numerous hands. Sometimes it goes through a committee or a group of individuals. For example, an organization may have a governance or management oversight to review major projects that have significant budgets. The difference between governance and management oversight is an important distinction. Governance oversight approves the controls and approach by which risk is to be managed. Management oversight executes within the rules set by the governance body. For example, a governance committee may say all projects costing more than $50,000 must be ...