Governing for Enterprise Security Implementation Guide

This guide is designed to help business leaders implement an effective program to govern information technology (IT) and information security. Our objective is to help you make well-informed decisions about many important components of GES such as adjusting organizational structure, designating roles and responsibilities, allocating resources (including security investments), managing risks, measuring results, and gauging the adequacy of security audits and reviews. The intent in elevating security to a governance-level concern is to foster attentive, security-conscious leaders who are better positioned to protect an organization’s digital assets, its operations, its market position, and its reputation.

Be forewarned - security is a relatively new area of governance for most organizations. It can be complicated for newcomers to IT and information security. Although the U.S. government has encouraged executives to take a more active role, many still do not understand that security requires action at the governance level. Based on organizations’ growing dependence on IT and IT-based controls, information and IT security risks increasingly contribute to operational and reputational risk. Leaders must understand the legal, technical, managerial, and operational considerations that converge in an enterprise security program (ESP). Reading short executive summaries will not suffice. As with audit and compliance responsibilities, boards and senior officers need to thoroughly understand effective enterprise security governance and how to bring it about. For instance, beyond comprehending organizational structure, roles, and responsibilities, leaders need to understand the more detailed responsibilities and tasks required to develop and operate a sustainable security program. Tackling GES is complex, and requires learning information and gaining knowledge that is missing in many organizations today.

The GES Implementation Guide, uploaded by the Software Engineering Institute, provides such guidance by providing a roadmap that describes actions, roles and responsibilities, and documented outcomes that occur at each step in the roadmap.

The attached Zip file includes:

• Intro Page.doc

• Cover Sheet and Terms.pdf

• Governing for Enterprise Security Implementation Guide.pdf

Related Knowledge Network Content

•CMMI for Services, Version 1.2

•A Practical Field Guide to ISO 9001:2008 Excerpt

•A Scenario-Based Technique for Developing SOA Technical Governance