Ads by TechWords

See your link here
Receive the latest technology news and information.
Security
Computerworld Daily News (First Look and Wrap-Up)
Computerworld Blogs Newsletter
The Weekly Top 10
Cloud Computing
View all newsletters




Privacy Policy
 

Opinion: Getting to governance

Asserting information security's place at the management table

July 7, 2008 12:00 PM ET

Computerworld - Looking over his glasses with a librarian's stare, an executive recently told me, "You IT people love the word governance, but it just seems too...." His voice trailed off as he searched for a way to tactfully convey his sense that "information governance" was a linguistic wedge designed to throw open the doors of board-level access for unkempt geeks and help desk managers. Instead of "governance," more comfortable phrases were suggested: "information policy board," "data management" or perhaps "IT steering committee."

Governance is a powerful word, and its use in an IT context implies that information is important -- which of course it is. Stripping away the trappings of applications, systems and networks, information is the core asset of most organizations. Establishing information governance is not, as some might think, the elevation of firewall administration to a board-level duty, and it doesn't mean the security controls that protect information subvert all other business processes.

Quite to the contrary, if information governance is planned and managed properly, information security controls end up being close parallels to, or integrated within, existing business processes. It is the establishment and maintenance of a connection between the organization's most valuable assets and the organization's control structure. Embracing governance concepts is the admission that we have assets we've ignored and that there needs to be some sort of structure that makes information tangible, addressable and protected.

"We've got some rules around here"

When challenged to explain information governance to executives, it's easy to digress into academic and philosophical debates over the centrality of information in a business. But that structure -- identifying information so that it's tangible and can be protected -- is the essence of governance. It's the explicit statement that there are rules about how people use processes and technology that affect or protect information.

The good news is that the concepts surrounding governance are becoming more easily understood as the professional dialogue and community body of knowledge becomes more mature and refined. A few years ago, one might have had to dig through the ISO 20000 IT service management (or the IT Infrastructure Library) and ISO 27001 (security management) standards to find the right words about establishment of a "management system" and to explain the desired governance framework for an information-heavy organization. Now there are numerous voices -- some better than others -- providing definitions and discussion on the topic.

More recently, respectable certifications have become available for professionals involved in the establishment or operation of information governance systems. For example, the Information Systems Audit and Control Association (ISACA) is administering its first test for the Certification in the Governance of Enterprise IT (CGEIT) this fall.



Jump to comments

jon espenschied

Additional Resources

Microsoft
Here are some of the key reasons why you would want to run Unified Access Gateway with DirectAccess.
Microsoft
Review how one energy firm tightened protection and simplified IT work using business-ready security solutions.
Sybase
In this white paper, IDC analyzes the role of next-generation mobile enterprise platforms as organizations seek a more strategic deployment of mobile solutions.

Learn the important issues you must consider before starting your next mobility initiative. Get your mobility white paper from IDC now, compliments of Sybase.

What People Are Saying

White Papers & Webcasts

Death to PST Files
Download Now  

Web 2.0, Social Media and the Dark Web - A Web Criminals Paradise?
In this discussion, learn about the challenges of protecting your users from the potentially unsafe content hidden in the "Dark Web".

eGuide: Enterprise Security
Smart Security Strategies for 2010. Read now!  

Disaster Recovery 2008: Reduced Costs and Improved Performance
How long can your Enterprise afford to be without your data? With an accelerated disaster recovery program, you never have to answer this...


IT Jobs