Security Governance

Picture a board member asking the security lead four questions: what are we protecting and how much risk will we accept, could we keep serving customers if the data center flooded, would our staff spot a fake payment request, and how do we know any of it works? In the NIST Cybersecurity Framework (CSF) 2.0, governance is the GOVERN Function, through which an organization's cybersecurity risk management strategy, expectations and policy are established, communicated and monitored. The ISC2 CC exam outline names this whole domain Security Governance and lists four areas under it; the first, GRC planning (Plan Governance, Risk, and Compliance), plans governance together with risk management and compliance. Monitoring needs evidence of the result: in every area, a record of intent or activity is not, on its own, proof that the work succeeded. For a risk, that evidence includes an assessment of the effectiveness of the response assigned by its risk owner, the designated party responsible and accountable for ensuring that the risk is maintained in accordance with enterprise requirements (NIST IR 8286). In GRC planning, that evidence can come from an audit supporting operational assurance (whether a system's technical features are being bypassed or have vulnerabilities, and whether required procedures are followed), which examines whether a system meets stated or implied security requirements as well as system and organization policies (NIST SP 800-12r1); in resilience, from testing, which validates recovery capabilities (NIST SP 800-34r1); and in measurement, from effectiveness measures, which evaluate how well implementation processes and controls are working and whether they are meeting desired outcomes (NIST SP 800-55v1). In awareness, the result is behavior change, which a cybersecurity and privacy learning program should encourage as part of risk management, leading to a privacy and security culture (NIST SP 800-50r1).

GRC planning: Plan Governance, Risk, and Compliance covers the three activities as one program, frameworks and records, and who decides about each risk. Resilience: Understand Redundancy and Business Resilience covers the business impact analysis (BIA), redundancy, business continuity (BC) and disaster recovery (DR). Awareness: Understand Security Awareness covers security culture, social engineering (an attempt to trick someone into revealing information, such as a password, in the NIST glossary), phishing and password protection. Measurement: Measure Cybersecurity Effectiveness covers metrics tracked against a set target and reported, and key risk indicators (KRIs), metrics used to measure risk (NIST SP 800-55v1, section 4.4). A KRI's threshold is set from risk tolerance, the level of risk acceptable to an organization (NIST IR 8286C). As study-guide routing advice, place a test of one component, such as system recovery from backup media, in that component's area.

The CSF 2.0 has an organization prioritize cybersecurity outcomes in the context of its mission and stakeholder expectations, so in every area a problem is judged by what it means for the mission. Restoration order follows business criticality rather than the order in which systems failed, a risk is accepted by the role authorized to make that decision rather than by whoever found it, a user reports a suspicious message through the established channel instead of investigating alone, and a KRI value beyond its threshold is escalated instead of having the threshold raised to fit that value. Under the CSF 2.0, organizational leadership is responsible and accountable for cybersecurity risk (GV.RR-01), and roles, responsibilities and authorities related to cybersecurity risk management are established (GV.RR-02). Responsibilities for addressing enterprise risks are delegated to appropriate risk owners, and risk ownership's responsibility and accountability can be assigned to different roles (for example, in a federal agency, responsibility for information system risks to the System Owner and accountability to an Authorizing Official), so enterprise risk strategy should describe the roles responsible and accountable for risk decisions (NIST IR 8286). While a disruption is assessed, personnel safety remains the highest priority (NIST SP 800-34r1, section 4.2.3), so a recovery objective does not authorize putting people at risk.