Title: Information Security Planning and Governance
Course: IN 2001 Principle of Information Assurance > Section: Module 5: Chapter Five

Information Security Planning and Governance

Long term strategic planning is critical to the information security program and that the planning effort should have specific clearly defined goals for the organization.

1. The organization of the planning process from the broad goals and vision of the organization down to the division and subsequent levels of the organization.
2. The translation of goals at one level into actionable items at the next level depends on the skill of the executive in charge of that level and is more art than science.

Planning Levels

1. Planning occurs at every level translating strategic goals and objectives into tactical operational goals and objectives.
2. The chief information security officer (CISO) uses tactical plans to organize, prioritized and acquire resources for major projects.

Planning and the CISO
The primary objective of the CISO and the IS management team is to maintain the security strategic plan, which is a living document supporting the ideals expressed in the Enterprise Information Security Plan.

Information Security Governance

1. Governance describes the entire process of governing, or controlling, the processes used by a group to accomplish some objective.
2. Even though information security governance has been a strategic planning responsibility, it is often regarded as a technical rather than a management issue.
3. The five goals of information security governance:
  - Strategic alignment of information security with business strategy to support organizational objectives
  - Risk management by executing appropriate measures to manage and mitigate threats to information resources
  - Resource management by utilizing information security knowledge and infrastructure efficiently and effectively
  - Performance measurement by measuring, monitoring and reporting information security governance metrics to ensure that organizational objectives are achieved
  - Value delivery by optimizing information security investments in support of organizational objectives