{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/governance","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/governance/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/governance/"},"term":{"en":"Governance","da":"Governance"},"aka":{"en":["security governance","information security governance"],"da":["sikkerhedsstyring","styring"]},"domain":["security"],"cluster":"fundamentals","layer":"governance","status":"current","summary":{"en":"How leadership steers security - setting direction, handing out responsibility and checking that it works.","da":"Hvordan ledelsen styrer sikkerheden - sætter retningen, fordeler ansvaret og tjekker, at det virker."},"body":{"formal":{"en":"The system by which an organisation's leadership sets security goals, assigns roles and responsibility, decides how much risk is acceptable, and follows up on results.","da":"Den måde, hvorpå organisationens ledelse fastsætter mål for sikkerheden, fordeler roller og ansvar, beslutter, hvor meget risiko der kan accepteres, og følger op på resultaterne."},"plain":{"en":"Like the captain of a ship - the crew does the rowing, but someone must choose the course and answer for where the ship ends up.","da":"Som kaptajnen på et skib - besætningen ror, men nogen skal vælge kursen og stå til ansvar for, hvor skibet ender."},"inPractice":{"en":"The board of a Danish pension fund names a security lead, approves the security policy and asks for a risk report every quarter - and under DORA its members must also take security training themselves.","da":"Bestyrelsen i en pensionskasse udpeger en sikkerhedsansvarlig, godkender sikkerhedspolitikken og beder om en risikorapport hvert kvartal - og efter DORA skal ledelsen også selv gennemgå et kursus i sikkerhed."},"whyItMatters":{"en":"Without clear steering from the top, security stays a scattered IT task with no budget, no owner and no one to answer when things go wrong.","da":"Uden klar styring fra toppen forbliver sikkerhed en spredt IT-opgave uden budget, uden ejer og uden nogen, der står til ansvar, når det går galt."}},"deepDive":{"en":"Governance is conventionally separated from management. ISO/IEC 38500 and COBIT 2019 describe the governing body's role as evaluate, direct and monitor, while management plans, builds, runs and monitors within that direction; ISO/IEC 27014:2020 applies the same split to information security. In NIST CSF 2.0 (2024) governance became a sixth function, Govern, placed around the other five, with the categories Organizational Context (GV.OC), Risk Management Strategy (GV.RM), Roles, Responsibilities and Authorities (GV.RR), Policy (GV.PO), Oversight (GV.OV) and Cybersecurity Supply Chain Risk Management (GV.SC).\n\nThe central decisions are risk appetite and accountability. Risk appetite is the amount and type of risk the organisation is willing to pursue or retain in pursuit of its objectives; risk tolerance translates it into measurable limits, such as the maximum acceptable downtime for a critical service or the share of critical vulnerabilities older than a set number of days. Accountability is made explicit through named information and system owners, a CISO or security coordinator with a defined reporting line, and decision rights over exceptions and accepted risks. ISO/IEC 27001:2022 clause 5 requires top management to demonstrate leadership, establish the security policy and assign roles, and clause 9.3 requires management review of the ISMS at planned intervals.\n\nRegulation has moved governance from good practice to legal duty. NIS2 Art. 20(1) requires the management bodies of essential and important entities to approve the cybersecurity risk-management measures, oversee their implementation and be liable for infringements, and Art. 20(2) requires members of those bodies to follow training; Art. 32(5) even allows a temporary ban on a person exercising managerial functions in an essential entity. DORA Art. 5 places ultimate responsibility for ICT risk on the management body of financial entities and requires its members to keep their ICT risk knowledge up to date.\n\nMany organisations structure assurance around the Institute of Internal Auditors' Three Lines Model (2020): management owns and operates risk and controls, specialist functions such as security and compliance provide expertise and challenge, and internal audit provides independent assurance to the governing body. Typical failure modes are a CISO reporting several levels below the board through IT, which creates a conflict of interest, risk registers with no one authorised to accept risks, metrics that report activity rather than risk, and boards that receive technical dashboards they cannot act on. Governance differs from risk management, which analyses and treats risks within the appetite governance sets, and from compliance, which checks conformity with external and internal requirements.","da":"Governance adskilles traditionelt fra ledelse og drift. ISO/IEC 38500 og COBIT 2019 beskriver det øverste ledelsesorgans rolle som at evaluere, dirigere og overvåge, mens den daglige ledelse planlægger, bygger, driver og følger op inden for den retning; ISO/IEC 27014:2020 anvender samme opdeling på informationssikkerhed. I NIST CSF 2.0 (2024) blev governance en sjette funktion, Govern, placeret omkring de fem øvrige, med kategorierne Organizational Context (GV.OC), Risk Management Strategy (GV.RM), Roles, Responsibilities and Authorities (GV.RR), Policy (GV.PO), Oversight (GV.OV) og Cybersecurity Supply Chain Risk Management (GV.SC).\n\nDe centrale beslutninger handler om risikoappetit og ansvar. Risikoappetit er den mængde og type risiko, organisationen er villig til at søge eller bære for at nå sine mål; risikotolerance omsætter den til målbare grænser, fx den maksimalt acceptable nedetid for en kritisk tjeneste eller andelen af kritiske sårbarheder, der er ældre end et fastsat antal dage. Ansvaret gøres eksplicit gennem navngivne informations- og systemejere, en CISO eller sikkerhedskoordinator med en fastlagt rapporteringsvej og beslutningskompetence over undtagelser og accepterede risici. ISO/IEC 27001:2022 afsnit 5 kræver, at topledelsen udviser lederskab, fastlægger sikkerhedspolitikken og tildeler roller, og afsnit 9.3 kræver ledelsens evaluering af ISMS'et med planlagte mellemrum.\n\nReguleringen har gjort governance fra god praksis til lovpligt. NIS2 art. 20, stk. 1, kræver, at ledelsesorganerne i væsentlige og vigtige enheder godkender foranstaltningerne til styring af cybersikkerhedsrisici, fører tilsyn med gennemførelsen og kan holdes ansvarlige for overtrædelser, og art. 20, stk. 2, kræver, at medlemmerne af ledelsesorganerne deltager i uddannelse; art. 32, stk. 5, giver endda mulighed for midlertidigt at forbyde en person at udøve ledelsesfunktioner i en væsentlig enhed. DORA art. 5 placerer det endelige ansvar for IKT-risiko hos ledelsesorganet i finansielle enheder og kræver, at medlemmerne holder deres viden om IKT-risici ajour.\n\nMange organisationer strukturerer sikkerheden for kontrol efter Institute of Internal Auditors' Three Lines Model (2020): den daglige ledelse ejer og driver risici og kontroller, specialistfunktioner som sikkerhed og compliance bidrager med ekspertise og udfordring, og intern revision giver uafhængig sikkerhed over for det øverste ledelsesorgan. Typiske fejl er en CISO, der rapporterer flere niveauer under bestyrelsen via IT, hvilket skaber en interessekonflikt, risikoregistre uden nogen med bemyndigelse til at acceptere risici, målinger, der rapporterer aktivitet frem for risiko, og bestyrelser, der modtager tekniske dashboards, de ikke kan handle på. Governance adskiller sig fra risikostyring, der analyserer og håndterer risici inden for den appetit, governance fastsætter, og fra compliance, der kontrollerer overensstemmelse med eksterne og interne krav."},"edges":[{"type":"used-with","to":"security/risk-management","why":{"en":"Governance sets how much risk is acceptable; risk management works out where the organisation stands against that.","da":"Governance fastlægger, hvor meget risiko der kan accepteres; risikostyring finder ud af, hvor organisationen står i forhold til det."},"confidence":"high","strength":"primary"}],"depth":0,"sources":[{"title":"Cyber Security Fast Track - Ordliste","tier":"course-material"},{"title":"NIST Cybersecurity Framework (CSF) 2.0 - Govern function","tier":"standard","publisher":"NIST"}],"draft":true}