Assignment 4: Information Security Governance

Information security management and governance are not simply implemented tasks within organizations. An information security governance program is a program that must be thoroughly planned, include senior-level management involvement and guidance, be implemented throughout the organization, and be updated and maintained. The International Organization for Standards (ISO) and the International Electrotechnical Commission (IEC) has created information security governance standards. Review the guide "Information Security Governance: Guidance for Board of Directors and Executive Management" prepared by the IT Governance Institute.

Write a paper in which you:

1. Define the information security governance and management tasks that senior management needs to address.


2. Describe the outcomes and the items that will be delivered to the organization through the information security program.


3. Develop a list of at least five best practices for implementing and managing an information security governance program within an organization.


4. Develop a checklist of items that needs to be addressed by senior management, including priorities and needed resources.


5. Use at least three quality resources in this assignment. Note: Wikipedia and similar Websites do not qualify as quality resources.

Your written paper must follow these formatting requirements:

This course requires use of new Student Writing Standards (SWS). The format is different than other Strayer University courses. Please take a moment to review the SWS documentation for details.

(Note: You’ll be prompted to enter your Blackboard login credentials to view these standards.)

• Your paper should include a cover page.


• Your paper should be of sufficient length to fully develop your own ideas that address the items called for in the instructions, and not be filled with “filler” information. Write clearly and concisely.


• The paper should be double-spaced, 12-point font.

The specific course learning outcomes associated with this assignment are:

• Examine the principles requiring governance of information within organizations.


• Use technology and information resources to research legal issues in information security.


• Write clearly and concisely about information security legal issues and topics using proper writing mechanics and technical style conventions