Governing for Enterprise Security (GES) Implementation Guide Available

SEI has posted a Governing for Enterprise Security (GES) Implementation Guide. It is a great read.

Below is an overview and the table of contents.

Overview (from SEI site)

Governing for enterprise security means viewing adequate security as a non-negotiable requirement of being in business. If an organization’s management does not establish and reinforce the business need for effective enterprise security, the organization’s desired state of security will not be articulated, achieved, or sustained. To achieve a sustainable capability, organizations must make enterprise security the responsibility of leaders at a governance level, not of other organizational roles that lack the authority, accountability, and resources to act and enforce compliance.

This implementation guide builds upon prior publications by providing prescriptive guidance for creating and sustaining an enterprise security governance program. It is geared for senior leaders, including those who serve on boards of directors or the equivalent. Throughout the implementation guide, we describe the elements of an enterprise security program (ESP) and suggest how leaders can oversee, direct, and control it, and thereby exercise appropriate governance.

Elevating security to a governance-level concern fosters attentive, security-conscious leaders who are better positioned to protect an organization’s digital assets, operations, market position, and reputation. This document presents a roadmap and practical guidance that will help business leaders implement an effective security governance program.

Table of contents (from guide)

Acknowledgments.. vii
Executive Summary.. ix
Abstract.. xi
1 Governing for Enterprise Security (GES).. 1
1.1 Governing for Enterprise Security Definitions.. 3
1.2 Eleven Characteristics of Effective Security Governance.. 5
1.3 Effective versus Ineffective Security Governance.. 7
1.4 Ten Challenges to Implementing an Enterprise Security Program.. 10
1.5 Conclusion.. 14
2 Defining an Effective Enterprise Security Program.. 16
2.1 Introduction.. 16
2.2 Roles.. 20
2.3 Responsibilities.. 21
2.4 Activities and Artifacts.. 26
2.5 Conclusion.. 33
3 Enterprise Security Governance Activities.. 34
3.1 Governance Approach.. 34
3.2 Governance Activities.. 34
3.3 Additional Considerations.. 59
3.4 Conclusion.. 61
3.5 Summary.. 62
Appendix A Board Risk Committee: Mission, Goals, Objectives, and Composition.. 64
Appendix B: Cross-Organizational Team (X-Team): Mission, Goals, Objectives, and
Composition.. 67
Appendix C: Roles and Responsibilities for an Enterprise Security Program.. 70
Author Biographies.. 83
Podcast Overview.. 84
Acronyms.. 86
Glossary.. 90
References.. 93

Get it here.
_