Governance and due care

Governance sets security aims, risk boundaries and accountability; management organizes control implementation and measurement. A security team cannot alone declare a business loss acceptable because mitigation is expensive. The board or delegated body sets risk appetite and resources. A business owner owns the process consequence; security specialists present treatment options and residual risk. Control operation can be delegated, while the designated decision authority remains accountable for the business decision. A useful record identifies asset, threat, likelihood, impact, alternatives, owner and review date. A checked box saying “risk accepted” without reasoning is weak evidence of a decision.

Due care involves appropriate continuing attention, investigation and improvement. Due diligence investigates before a transaction or decision. During an acquisition, the team seeks an inventory of systems, obligations, dependencies and known incidents, and examines a sample of evidence before connecting networks. An old vendor audit report does not establish current security. Determine its scope, period and exceptions, then verify what the new risk requires. A policy states approved direction; a standard specifies a mandatory, testable rule; a procedure describes execution steps; a guideline assists with choices. A data-protection policy might be implemented by a standard for portable-copy encryption, a key-rotation procedure and guidance with implementation examples. Confusing these layers leaves staff unable to test compliance or lets a low-level technical instruction masquerade as an approved governance decision.

Frameworks such as NIST, ISO or COBIT organize work and comparison. Naming one does not grant general compliance. Map a requirement to the actual environment: the asset, control scope, operator, evidence and exception. A control assessment should examine operation, not merely the existence of a written policy. A risk committee needs consequences, implementation cost and feasibility, residual risk, uncertainty and a reassessment date. A decision outside approved risk appetite or a binding legal constraint must be escalated; it cannot quietly become a risk-acceptance exception.