From Software Engineering Institute | Jul 27, 2009
This guide is designed to help business leaders implement an effective program to
govern information technology (IT) and information security. Our objective is to help
you make well-informed decisions about many important components of GES such as
adjusting organizational structure, designating roles and responsibilities, allocating
resources (including security investments), managing risks, measuring results, and
gauging the adequacy of security audits and reviews. The intent in elevating security
to a governance-level concern is to foster attentive, security-conscious leaders who
are better positioned to protect an organization's digital assets, its operations, its
market position, and its reputation.
Be forewarned - security is a relatively new area of governance for most
organizations. It can be complicated for newcomers to IT and information security.
Although the U.S. government has encouraged executives to take a more active role, many
still do not understand that security requires action at the governance level. Based on
organizations' growing dependence on IT and IT-based controls, information and IT
security risks increasingly contribute to operational and reputational risk. Leaders
must understand the legal, technical, managerial, and operational considerations that
converge in an enterprise security program (ESP). Reading short executive summaries
will not suffice. As with audit and compliance responsibilities, boards and senior
officers need to thoroughly understand effective enterprise security governance and how
to bring it about. For instance, beyond comprehending organizational structure, roles,
and responsibilities, leaders need to understand the more detailed responsibilities and
tasks required to develop and operate a sustainable security program. Tackling GES is
complex, and requires learning information and gaining knowledge that is missing in
many organizations today.
The GES Implementation Guide provides such guidance by providing a roadmap that
describes actions, roles and responsibilities, and documented outcomes that occur at
each step in the roadmap.
The attached Zip file includes:
- Intro Page.doc
- Cover Sheet and Terms.pdf
- Governing for Enterprise Security Implementation Guide.pdf
