In this lesson we're going to talk about
governance and compliance.
Now, governance refers to the overall management
of the organization's IT infrastructure,
policies, procedures, and operations.
This involves the establishment
of a strategic framework that aligns with
the organization's objectives and regulatory requirements.
This framework includes the rules, responsibilities
and practices that are going to guide an organization
in achieving its goals and managing
its overall IT resources.
Now, governance is crucial for several reasons,
including risk management strategic alignments,
resource management and performance measurement,
and many others.
In terms of risk management, governance helps us
to identify, assess and manage potential risks
that could impact our organization's security.
Strategic alignment, on the other hand,
is a fancy way of saying that we want to ensure
the organization's IT strategy aligns
with its overall business objectives.
Resource management, on the other hand,
is going to be supported by governance
by making sure we have an efficient
and effective use of our resources.
And performance measurement is going to be focused on
making sure we have mechanisms in place for monitoring
and measuring the performance of our IT processes.
After that, we're going to start talking about compliance.
Now, compliance on the other hand,
is going to refer to the adherence to laws,
regulations, standards and policies
that apply to an organization's operations.
In the IT world, compliance means ensuring
that the organization's IT systems and processes
meet the required security standards and regulations.
Compliance is important for many reasons,
including legal obligations, trust and reputation,
data protection, and business continuity.
Now, in terms of legal obligations
if you have non-compliance this can lead to legal penalties,
including fines and sanctions against your company.
In terms of trust and reputation,
we need to make sure we have compliance
with our industry standards and regulations
to enhance our organization's reputation
and foster trust among our customers and our partners.
When it comes to data protection,
compliance is going to help us by making sure
that we're going through the data protection regulations
properly to prevent data breaches and protect our privacy
of our customers and employees' data.
Now, in terms of business continuity,
our compliance with standards related to disaster recovery
and business continuity can really help to ensure
that our organization can continue to operate
in the event of a disaster or disruption to our services.
So in this section of the course,
we're going to be focused solely on domain five,
and specifically we'll be looking at objective 5.1
and objective 5.4.
Now, objective 5.1 states that you must be able
to summarize elements of effective security governance
and objective 5.4 states that you must be able to
summarize elements of effective security compliance.
Now, first, we're going to cover governance
and we're going to go over much more detailed definition
of governance as part of governance, risk and compliance
and how these three will affect guidelines,
policies, standards, and procedures.
We'll also go over the need for monitoring
and revision of your governance as technology,
regulatory and cultural changes occur within your industry.
Then we'll jump into a discussion
on the different governance structures,
including boards, committees government entities,
and centralized versus decentralized structures.
We'll also explain each of these in detail
and how they work and fit into
your overall organization.
After that, we'll talk about policies.
Now, policies are high level guidelines
that outline the organization's commitments
and intentions towards certain actions,
such as data protection or ethical conduct.
We're going to be discussing lots of topics in this lesson,
including acceptable use policies,
information security policies, business continuity policies,
disaster recovery policies, incident response policies,
change management policies and the overall
software development lifecycle known as the SDLC.
Then we're going to focus on standards.
Standards are specific mandatory actions or rules
that must be followed to adhere to a policy
and these are often defined by an industry
or regulatory body.
We're also going to be covering things
like password standards, access control standards,
physical security standards, and encryption standards.
Following that, we'll start talking about procedures.
Now, procedures are step-by-step instructions
on how to perform specific tasks
or activities to ensure consistency
and compliance with both policies and standards.
We're going to be going over change management procedures,
onboarding and off-boarding procedures
and the use of playbooks.
Then we'll take a look at governance considerations,
including regulatory considerations, legal considerations,
industry considerations, local and regional considerations,
national considerations, global considerations,
and we'll also look at some of your legal issues
that your organization could face if you went astray
of any of these governance considerations.
After that, we'll dive into compliance
and we'll be discussing compliance, monitoring and reporting
as we explain the different concepts like due diligence
and due care, attestation and acknowledgement,
internal and external compliance,
and the use of automation in your compliance processes.
Then we'll cover the consequences of non-compliance,
including fines, sanctions, reputational damage,
the loss of your license, and contractual impacts.
Finally, we're going to take a short quiz
to see what you learned during this section of the course
and review each of those quiz questions fully
to ensure that you can explain why each answer was right
and why the wrong ones were wrong.
So let's go ahead and jump into governance and compliance
in this section of the course.