Governance is the framework of policies, structures, and oversight that directs and controls an organization’s security. It keeps security aligned with business goals, puts resources where the risk is, applies risk decisions consistently, and makes accountability clear. Crucially, it originates with the board and executive leadership, not the IT department.
In practice, governance sets the security strategy, issues the policies and standards, defines roles, and builds the oversight that checks whether any of it is working. The mindset that separates strong governance from weak is treating security as a business responsibility owned at the top, rather than a technical chore delegated downward and forgotten. When leadership signs a policy but never funds or enforces it, governance exists only on paper. Clear metrics help here, giving leadership a way to see whether the strategy is producing results rather than mere activity.
How is governance tested on the CISSP?
Domain 1: Security and Risk Management leans heavily on governance. Know the role of senior management and the board, the document hierarchy of policies, standards, procedures, and guidelines, and how governance produces consistent security. The exam rewards a managerial view, not a purely technical one.