Information Security Governance practice questions

Accountability for information security governance belongs to the board and executive management.

Responsibility for activities can be assigned down the organization, but accountability for whether information security is adequately governed rests with the board and executive management. The CISO is responsible for the program and for keeping leadership informed; IT and custodians operate controls. When the question asks for ultimate accountability, the answer is the governing level.

1. Note the words 'ultimate accountability' rather than 'responsibility'.
2. Place each role: governing body, executive, specialist, operator.
3. Pick the governing level.
4. Remember the CISO answers to leadership for the program.

Exam tip: Senior leadership is accountable for security governance; the CISO is responsible for running it.

The security function's reporting line determines how independently it can raise risk and compete for resources.

When security reports into the CIO, the person who owns IT delivery also controls the security budget, so security priorities lose whenever they compete with IT projects. That is a conflict of interest in the structure. Moving the reporting line to an executive independent of IT operations (for example the CEO, COO or chief risk officer) addresses the cause. A fixed budget share and a vote on the IT board are workable tactics but leave security subordinate to IT; making audit approve budgets breaks audit's independence.

1. Identify the symptom: security loses budget contests inside IT.
2. Ask what in the structure causes it: IT controls security's priorities.
3. Compare the options that fix the symptom with the one that removes the conflict.
4. Reject any option that puts internal audit into management decisions.

Exam tip: When security keeps losing to IT priorities, look at the reporting line: independence from IT fixes the cause.

A steering committee works when the people who own business priorities sit on it.

The point of a security steering committee is to align security with the business, set priorities and win commitment across functions. That needs senior leaders from the business units affected, alongside security, IT, legal and risk. A committee of technical leads, a pair of specialists or one led by IT cannot commit the whole business to decisions or resolve conflicts between functions.

1. Ask what the committee is for: alignment and cross-functional commitment.
2. Ask which members can commit their part of the business.
3. Pick senior business representation.
4. Reject technical, specialist-only or IT-led memberships.

Exam tip: Steering committees need senior business owners at the table, not only security and IT.

A security steering committee is the governance forum for cross-functional priorities and disputes.

Case-by-case escalation to the CEO shows there is no standing body with the authority to decide how the policy applies across units. A steering committee of senior business leaders with the security manager provides that forum: consistent decisions, recorded and owned by the business. Liaisons are a useful second structure for day-to-day application but have no authority across units; more detailed procedures still leave conflicts; audit should stay independent.

1. Identify the gap: no forum with authority across business units.
2. Compare the two workable structures: local liaisons and a central committee.
3. Pick the one with authority over cross-unit conflicts.
4. Reject options that compromise audit or only add detail.

Exam tip: Conflicts between business units need a cross-functional forum with authority: a steering committee.

Information owners authorize access; custodians implement it.

Access decisions are business decisions about who needs the data to do their job, so they belong to the information owner, normally a senior manager in the business unit. The DBA and IT act as custodians who implement the approved access. The security manager designs the process, standards and monitoring but does not own the business's data.

1. Identify whose data it is: the business unit's.
2. Separate deciding access from implementing it.
3. Pick the business owner.
4. Place the DBA and IT as custodians and security as process owner.

Exam tip: Owners approve access to their information; custodians carry it out.

Owners decide and review access; custodians implement; security designs the process.

The weakness is that the custodian has become the decision maker. The fix is to restore the owner's role: the HR director, as information owner, approves access (and later recertifies it), and the DBA implements those decisions. Central approval by security is the tempting near-twin, but it still takes the decision away from the business that understands the need. Logging only detects, and stripping the DBA's rights removes the implementer rather than the wrong decider.

1. Name the weakness: the custodian is deciding access.
2. Ask who is accountable for HR data: the HR director.
3. Compare the two approval options: security versus owner.
4. Choose owner approval; reject detective-only and disruptive fixes.

Exam tip: When a custodian is deciding access, move the decision back to the owner, not to security.