|
Work item:
|
X.1054
|
|
Subject/title:
|
Information security, cybersecurity and privacy protection - Governance of information security
|
|
Status:
|
Approved on 2021-04-30
|
|
Approval process:
|
TAP
|
|
Type of work item:
|
Recommendation
|
|
Version:
|
Rev.
|
|
Equivalent number:
|
ISO/IEC 27014 (Common)
|
|
Timing:
|
-
|
|
Liaison:
|
-
|
|
Supporting members:
|
-
|
|
Summary:
|
Information security is a key issue for organizations, amplified by rapid advances in attack methodologies and technologies, and corresponding increased regulatory pressures.
The failure of an organization's information security controls can have many adverse impacts on an organization and its interested parties including but not limited to the undermining of trust.
Governance of information security is the use of resources to ensure effective implementation of information security, and provides assurance that:
o directives concerning information security will be followed; and
o the governing body will receive reliable and relevant reporting about information security related activities.
This assists the governing body to make decisions concerning the strategic objectives for the organization by providing information about information security that may affect these objectives. It also ensures that information security strategy aligns with the overall objectives of the entity.
Managers and others working in organizations need to understand:
- the governance requirements that affect their work; and
- how to meet governance requirements that require them to take action.
|
|
Comment:
|
-
|
|
Reference(s):
|
|
|
Historic references:
|
|
Contact(s):
|
|
| ITU-T A.5 justification(s): |
|
|
|
|
First registration in the WP:
2017-10-16 17:53:56
|
|
Last update:
2022-02-23 12:28:47
|
