- Hello, and welcome back to the channel.
I'm Marcus from InfoSec Governance.
And in today's video, we're going to be talking about
what information security governance is
and how it benefits you and your business.
So what is information security governance?
Basically information security governance,
or InfoSec governance, or IS governance
is the process which allows you, the business,
to control and direct the approach
on how you handle information security.
When this is performed correctly,
implementing the governance will allow your business
to efficiently coordinate and manage
the security activities of the business.
This means that it will help you manage
the flow of information, as well as helping you
to define the decisions around the business
regarding the information security.
So when it comes to security within the business,
it's not just about one person who has
the sole responsibility to manage all aspects
of information security within your business.
It's the responsibility of everyone,
whether it's from the board of directors or the owner,
all the way down to the cleaner or security guards.
Everyone should be aware that they have
a say when it comes to security.
But how do you go about implementing
information security governance within your business?
Unfortunately, there's not a one size fits all
approach to this.
It would be nice if there was
but what normally works for one business may or may not
work for another.
For example, one business who may implement ISO 27001
or have other standardised frameworks in place,
may go for a more formalised approach.
Whereas a smaller business may go for more
an informal approach and just go around
hearsay and words and just talk and discuss.
One thing however that you may need to be aware of though,
is that if you do go down the informal route
you should still ensure that you have
a documented framework in place.
This way, staff within the business know what to do
and what everyone else needs to do.
And what's expected of them.
For example, if you base your security governance
on ad hoc requests in management,
then things could quite easily go wrong.
But how do you decide how to structure
and formalise your governance?
Well, you could start by asking yourself
the following questions.
How large and complex is your business?
Do you have multiple sites?
Is it international?
Do you already have some technical resources
within your business, like a dedicated IT team?
If you do have a dedicated IT team,
do you already have some informational security expertise
within this environment?
Do you already have login in place for auditing?
Have you worked out how important
the security of your information is?
What would happen if your information was lost or stolen?
Do you have any external considerations to be aware of?
For example, do you have suppliers, contractors
that come onsite?
Do you have a managed reception
or can anyone just walk into your office?
Once you've asked yourself all these questions
then you should be in a good place to understand
what security decisions need to be made,
or at least have a foundational understanding in place.
Second, you should also know
who you need to bring in as part of your governance team.
Lastly, you should have the information available
to start building your framework
and implementing your information security governance.
This is all fair enough.
And there's a lot of buzzwords in place in this video.
Which for large organisations, uh, spit my words out.
For large organisations this is pretty fine, since.
But what about for smaller non-technical companies?
What should your approach to governance be?
Basically, you should look at your business locations,
identify any external people
who have access to locations and possibly information,
physical assets, identify who should be responsible
for security within the business.
This should be across all levels
and you should have buy-in from your management team.
You should ensure that you have accountability in place.
And have feedback is provided
back to the stakeholders of the company.
Lastly, you should also identify your business goals
and priorities
and what the requirements are for this project.
Why do you want to implement information security?
What do you want to get out of it?
Why do you want to implement it?
When do you want to implement it by?
What do you want to safeguard?
And the list goes on.
One thing you should be aware of
when it comes to information security governance
is that there isn't a wrong way to do things.
What works for you may or may not work for another company.
Don't just over-complicate a solution
just because someone else is doing it that way.
But you should make sure that your document, code,
and have owners of processing throughout the whole process.
You should ensure that people are known for a certain part
of the framework and always start off slowly.
Once your framework has started, look at it.
Tweak it out as you grow in confidence
and identify areas that either need more work
or don't work as expected.
The governance framework is a living framework
and should not be forgotten about.
And that is it.
I hope this video has been informative for you.
It is a quick introduction
into information security governance.
If you liked the video,
if you'd like to know more about it, you know
feel free to put a comment in below the video,
like the video so we know that you've actually looked at it
and it's of interest to yourselves.
And with that, I'll see you next time.
Thanks
(upbeat music)