Glossary 📋 Governance

Compliance & Governance

Security policies

Written rules that set expectations for how the organization and its people handle security.

Why this matters

Clients, insurers, and regulators increasingly ask businesses to show how they protect data, and a basic program makes those questions easier to answer.

More in Governance

Risk managementIdentifying what could go wrong, how likely and harmful it is, and deciding how to handle each risk.AuditsIndependent or internal reviews that check whether security controls exist and work as described.Vendor reviewsAssessing the security of suppliers and service providers that handle your data or connect to your systems.Regulatory complianceMeeting security and privacy requirements set by laws and regulations that apply to your business.Security awarenessTraining that helps staff recognize phishing, scams, and unsafe habits, and know how to report concerns.NIST CSFThe NIST Cybersecurity Framework 2.0 organizes security into six functions: Govern, Identify, Protect, Detect, Respond, Recover.ISO 27001An international standard for running an information security management system, which organizations can be certified against.CIS ControlsA prioritized list of practical security safeguards from the Center for Internet Security, grouped into implementation levels.SOC 2An independent auditor's report on a service provider's controls for security and related areas like availability and confidentiality.PCI DSSThe Payment Card Industry Data Security Standard sets security requirements for businesses that store, process, or transmit card data.

Want help with governance?

Tell me what you have and I'll tell you which few things actually matter for you.

Get in touchSee what I offer