We've started to talk a little bit about governance already. We said governance is how we make decisions, how we tell people how to behave, and this related to our administrative controls. We're going to look at governance elements. We're going to look specifically at things like compliance, regulations and laws, but also some of that internal governance; standards, policies, procedures, and recommendations. Compliance. Compliance can be an external requirement. For privacy, we said you have to comply with regulations, you have to comply with laws. These can arise externally. We can also have internal compliance requirements. We have a set of standards policies that we have to meet. Then that compliance has been agreed by the board. We have to meet that there's something that we have to comply with. The policies, the procedures, the standards, the guidelines, those are things that we have talked that have been agreed at some point within the organization that we have to follow. Laws and regulations might mean that our internal policies, and procedures are shaped in a way that complies with the laws and the regulations. Similarly, we said standards, things you must do, guidelines, recommendations. These may arise externally. They could relate to your particular industry sector. But they may be internal standards and guidelines. Somebody could have said, well look, this is best practice, this is how we are going to behave. You will have these standards for encryption as an example. This links very much to the type of industry that you're in. Increasingly, industries are regulated. Privacy regulation is growing globally. But also we see health care, finance, military, government, communications, transport, all those critical national infrastructure elements are typically regulated. We talked already about ISO 27001, the cybersecurity standards that you can be certified to. It's the definitive standard, an international standard that sets out the specification for your information security, the documentation risk approach and controls. But ISO also have another document on cybersecurity management. This is ISO 27032, supposed to again be an international definitive standard, offering guidance on what to do, so you cannot be certified to this standard. The standard recognizes the different vectors that cyberattacks rely on and helps provide guidance on how to protect your organization from them. We said SPA800, special publication 800-53 is NIST control document, control framework, and we also have NIST cybersecurity framework. The cybersecurity framework was designed to help organizations identify their capabilities, and needs to help an organization identify where they are currently, their current posture, and where they want to be their target state: so your current state and your target state. Think about this as planning a journey. In order to travel somewhere, you need to know where you are, you need to know where you want to go. Then the gap between those two points gives you a roadmap. Literally when you're traveling a map across the roads, maybe. But the same is true for cybersecurity. If you can identify where you are, where you want to be, you can identify the gap and that becomes a road-map for you to go from where you are to where you need to be. The framework is divided into different tiers and profiles, and the profiles give you examples of different industries, and you try to recognize where you are within that continuum. We're a telecommunication provider, for example, and yeah, this profile looks like us, looks like where we are. That profile looks like where we want to be, and it helps you shape your next steps. It gives you effectively the basis for a strategy and the roadmap. Policies, we talked about policies. Policies are the high-level statement saying what we're doing. They should reflect the law, they should reflect the strategy and mission of the organization, and we said a good policy will explain why you're doing it. Doesn't have to, but a good policy will explain that because if people that have to follow this policy understand why it's asking you to do these things, they're more likely to comply. Policies are signed off by the senior leadership of the organization. One of those C-level officers, a member of the board. Procedures, are signed off at the next level down. Procedures are step-by-step instructions. They're signed off at a lower level, not at the next level down rather, but a lower level within the organization, within a business unit. Why they signed off at a low level? Well, the procedures are how we deliver the high-level policy, so how we deliver the policy. For example, we may have a backup policy that explains how we are going to protect data. The backup procedure might explain how you change the backup tapes. You remove the old tape, you put it in a secure location. You get the new tape, you insert it. Maybe you start the backup. Because these require specific knowledge usually related to a business area, so for the backups, maybe IT, then typically these procedures are signed off within that business area, the created within the business area. If a policy and procedure conflict in terms of contradicting each other, the policy usually takes precedence because it is signed off by the board. We would normally respect the policy over the procedure.
