- ✓Information security governance provides the strategic framework within which all security management activities take place.
- ✓ISO/IEC 27001 is the internationally recognised standard for information security management systems, providing a structured approach to managing sensitive information.
- ✓GDPR places legal obligations on organisations that process personal data, including requirements for security, transparency, and breach notification.
- ✓A Chief Information Security Officer provides senior leadership for security functions, ensuring that security is treated as a business priority.
- ✓Governance frameworks, technical controls, and a security-aware culture must work together to create genuinely effective organisational security.
Listen to the full episode inside the course. Enrol to access all 80 episodes, plus assignments, tutor support and Student Finance funding.
Start learning →Alex: Today we're looking at security governance and compliance. Sam, governance is the strategic level of security management, right?
Sam: Exactly. While operational security deals with day-to-day controls and monitoring, governance is about the overarching framework within which all security decisions are made. It answers questions like: who is responsible for security? How is security strategy set? How is security performance measured? How does security align with the broader goals of the organisation?
Alex: Where does responsibility for security sit in an organisation?
Sam: In larger organisations, there's typically a Chief Information Security Officer, or CISO, who is responsible for the organisation's information security programme. The CISO reports to senior leadership and the board, ensuring that security is treated as a business priority rather than just a technical concern. Below the CISO, there are security teams handling different aspects: architecture, operations, compliance, and incident response.
Alex: What about ISO 27001? That comes up a lot in security discussions.
Sam: ISO/IEC 27001 is the international standard for information security management systems. It provides a framework for establishing, implementing, maintaining, and continually improving information security across an organisation. Organisations can be formally certified against it, which provides assurance to customers and partners that a rigorous approach to security is in place. It covers everything from risk assessment to supplier security, access control, cryptography, and business continuity.
Alex: And GDPR? How does that interact with security governance?
Sam: GDPR, the General Data Protection Regulation, is UK and European Union data protection law that has significant security implications. It requires organisations to implement appropriate technical and organisational measures to protect personal data. It mandates that data breaches affecting personal data be reported to the Information Commissioner's Office within 72 hours. And it provides individuals with rights over their data. Failure to comply can result in fines of up to four percent of global annual turnover, which has concentrated minds at board level.
Alex: What other regulations are relevant to computing professionals?
Sam: It depends heavily on the sector. The Network and Information Systems Regulations apply to operators of essential services. PCI DSS, the Payment Card Industry Data Security Standard, applies to any organisation that processes card payments. In healthcare, organisations must comply with strict rules around patient data. Financial services are subject to regulations from the Financial Conduct Authority. Computing professionals need to understand which regulations apply to their organisation and ensure their systems and practices comply.
Alex: Is governance just about compliance, though?
Sam: No, and this is an important distinction. Compliance means meeting the minimum legal and regulatory requirements; it doesn't necessarily mean you're secure. Governance in the true sense is about building a security programme that genuinely reduces risk and protects the organisation, not just ticking regulatory boxes. The best organisations use compliance as a baseline and build significantly beyond it.
Alex: Brilliant. A really important distinction to end on. Thanks Sam. In our last Unit 5 lesson we look at the range of cyber attack types.