Every organization should have a well-defined information governance program to ensure that data is properly managed and protected. The Cloud Security Alliance recommends establishing formal policies and procedures for this governance program, getting them approved by leadership, communicating them throughout the organization, and reviewing them at least annually. Let's explore what this all means and how to make it happen.

Where did this come from?

This guidance comes from the CSA Cloud Controls Matrix v4.0.10 - 2023-09-26, specifically control ID GRC-01 in the Governance, Risk and Compliance domain. You can download the full Cloud Controls Matrix here to explore further. The goal of this control set is to ensure a comprehensive governance program is in place to manage organizational risks.

Who should care?

This matters to several roles:

• CISOs and other security leaders responsible for the overall security and compliance posture
• Governance, risk, and compliance (GRC) professionals who manage related programs
• Legal teams who need to ensure regulatory requirements are met
• Business unit leaders who are responsible for implementing applicable policies
• Auditors who verify the existence and effectiveness of the governance program

What is the risk?

Without a well-defined and enforced governance program, an organization faces several risks:

• Non-compliance with legal and regulatory requirements, which can lead to fines, penalties, and reputational damage
• Inconsistent security practices across the organization, increasing the attack surface
• Lack of accountability for security responsibilities
• Difficulty passing audits and demonstrating compliance to customers and partners
• Overall increased likelihood of a data breach or security incident

What's the care factor?

For most organizations, the care factor for governance should be high. Non-compliance and security incidents can be extremely costly - far more than the effort to put a solid governance program in place. This is especially true for organizations in heavily regulated industries or those that process sensitive data. However, smaller organizations with lower risk profiles may be able to start with a streamlined program and build from there.

When is it relevant?

A governance program is relevant for almost any organization that uses IT systems and processes data. However, the scope and complexity may vary:

• Highly regulated industries like finance and healthcare will need very comprehensive programs
• Organizations that process sensitive personal data or valuable intellectual property will want robust governance
• Small businesses and low-risk data sets can likely have a more basic program
• Organizations using only SaaS applications may rely more on vendor governance

What are the trade-offs?

Governance does come with costs and effort required:

• Establishing the program will take time from senior leadership, legal, and GRC teams
• Documenting and communicating policies takes time away from other priorities
• Restrictive policies may impact business agility and slow down projects
• Some employees may see policies and oversight as red tape
• Ongoing resources will be needed to update and enforce the program over time

The key is to right-size the level of governance to the risk profile and find the right balance.

How to make it happen?

Here's a basic roadmap to establish your governance program:

1. Assign an executive sponsor and form a governance committee with representation from legal, GRC, security, IT, and major business units.
2. Have the committee review relevant legal/regulatory requirements and organizational risks. Use this to determine the major domains your program needs to cover, such as:

• Information security
• Data privacy
• Industry-specific regulations
• Regional laws
• Contracts and vendor management
• Acceptable use policies
• Incident response

3. For each domain, identify existing policies you can leverage and gaps that need new policies. Prioritize based on risk level.
4. Create a policy document template including purpose, scope, roles & responsibilities, specific dos and don'ts, enforcement, and review cadence.
5. Assign each policy to an owner to draft the initial version. Have them collaborate with other SMEs and gather feedback.
6. Review draft policies with the governance committee and incorporate feedback.
7. Send policies to leadership for final approval.
8. Communicate the policies out to all employees, emphasizing leadership's support. Make them easily accessible.
9. Work with each department to implement any processes and controls needed to comply with the policies.
10. Establish an oversight function to monitor compliance, enforce violations, and gather metrics.
11. Review and update policies on a regular basis - at least annually. Adapt to any new risks or requirements.

What are some gotchas?

A few things to watch out for when implementing your governance program:

• Ensure you cover all relevant regulations for your industry and regions. Work with legal to get this right.
• Don't rely solely on policies. Look at technical controls, processes, and training needed to make them real.
• Make policies as easy to read and follow as possible. Get feedback from end users before finalizing.
• Policies are not a one-and-done effort. You need a process to keep them up-to-date and at front of mind.
• Enforcement is key. If there are no consequences for violations, people won't take policies seriously.
• Remember that policies apply to vendors and contractors too. Make sure their contracts include compliance.

What are the alternatives?

There aren't really alternatives to having a governance program altogether - it's a must for most organizations. However, there are some options in how you implement it:

• Smaller, lower-risk organizations can have a more lightweight program vs. hundreds of pages of policies.
• Use templates and examples from industry groups like CSA, ISO, and NIST to avoid starting from scratch.
• Consider governance, risk, and compliance (GRC) software tools to help automate assessments and monitoring.
• Look to auditors and consultants for help and advice in building your program.

Explore further

Here are some great resources to learn more about governance programs:

• NIST Cybersecurity Framework - Includes guidance on governance
• ISO/IEC 27014 Governance of Information Security
• ISACA Governance Resources
• CSA CCM v4.0.10 - The full Cloud Controls Matrix

This control also maps closely to:

• CIS Top 20 Control 17 - Governance and Risk Management
• NIST SP 800-53 PM-1 Information Security Program Plan

I hope this helps provide a solid foundation to establish or level up your information governance program. Remember, policies are just the start - but they're a critical piece to managing information risk. Work closely with your GRC team to tailor your program to your organization's unique needs. And don't hesitate to bring in outside expertise for help.

‍