- [Narrator] As a business function,
information security must align itself
with the many other functions taking place
inside an organization.
I already talked about some of the routine
management tasks that information security leaders
take on when managing human resources
and financial budgets.
Those are pretty much the same concerns
that any other manager in the organization has.
Let's take a look at the specific business processes
that have a security impact.
First, information security must align itself
with the governance processes of the organization.
These governance processes take place
at many different levels.
They may consist of an information governance committee
that includes senior leaders
with oversight of information security
and data governance functions.
The organization may also have a risk management committee
consisting of executives charged
with managing all risks to the organization
from any source.
In publicly traded companies and non-profit organizations,
the most senior level of governance
is typically an independent board of directors,
board of trustees, or similar senior governing body
with elected members.
No matter what the governance structure of the organization,
security leaders must determine
the best ways to integrate information security
into governance processes.
At a minimum, this means making sure
that those responsible
for the governance of the organization
understand the security risks
facing the organization and the controls
put in place to manage those risks.
Governing groups should also be informed
of any security incidents that take place
and review the results of audits
performed at the organization that include
security consideration.
There's no one size fits all model
for security governance,
and you'll need to figure out how to best address
security concerns within the specific context
of your organization.
Another corporate process that requires
security involvement comes from
the acquisition of other companies.
In some industries it's quite common
for businesses to buy other businesses
and then seek to quickly fold them into the parent company.
Each acquisition presents a unique set
of circumstances, and security professionals
from both organizations should get together
to evaluate the security controls in place
at each organization
and figure out how to eliminate redundancies
and ensure compatibility between security systems.
This can be a little bit tricky,
especially when the staff at one organization
fears that they may be laid off
as a result of the acquisition.
Threats to a team's continued employment
can have a very serious negative impact on productivity.
Similarly, companies sometimes undergo
divestitures where they spin off
a part of the business as a separate organization.
In those cases, individuals staying
with the divested company must ensure
that the new organization has adequate controls in place.
Those staying with the parent company
will need to ensure that all security ties are cut
and that there isn't any unintentional access
left over for employees who leave the company
with the divestiture.