CISSP Domain 1 - Topic: Security Governance

Описание: Security governance is the collection of practices related to supporting, defining, and directing the security efforts of an organization.
Security governance principles are often closely related to and often intertwined with corporate and IT governance.
Some aspects of governance are imposed on organizations due to legislative and regulatory compliance needs, whereas others are imposed by industry guidelines or license requirements. [1]
Governance can be quite complex as it varies from time to time, from industry to industry, from country to country, and requirements evolve due to regulations or best practices. [2]
Security governance is the implementation of a security solution and a management method that are tightly interconnected.
Security governance directly oversees and gets involved in all levels of security. [3]
Security governance is commonly managed by a governance committee or at least a board of directors.
Security is a complex task, and it requires a group of experts working together toward the goal of reliable security governance.
There are numerous security frameworks and governance guidelines, including NIST 800-53 or 800-100.
Organizations adopt security frameworks in an effort to standardize and organize what is often a complex undertaking – implementing reasonable security governance.