Information Security Governance: Guidance for Information Security Managers

This book discusses how to develop an information security strategy within an organization s governance framework and how to drive that strategy through an information security program. It provides guidance on determining information security objectives and how to measure progress toward achieving them. It is an exposition on the rationale and necessity for senior management to integrate information security into overall organizational governance at the highest levels. It provides information, developed in recent years, that mandates a business case for information security governance.

For continuity and clarity, some of the information from the companion publication, Information Security Governance: Guidance for Boards of Directors and Executive Management, 2nd Edition, is summarized in this document, a review of that publication is recommended for an understanding from a high-level strategic governance perspective.