• State that governance describes the entire process of governing, or controlling, the processes used by a group to accomplish some objective.
  Define the term governance and why the board of directors are the ones that must be involved to provide strategic direction. Note the five key tasks they are responsible for:
  Strategic direction
  Establishment of objectives
  Measurement of progress toward these objectives
  Verification that risk management practices are appropriate
  Validation that the organization’s assets are used properly
  List the five goals of information security governance:
  Strategic alignment of information security with business strategy to support organizational objectives
  Risk management by executing appropriate measures to manage and mitigate threats to information resources
  Resource management by utilizing information security knowledge and infrastructure efficiently and effectively
  Performance measurement by measuring, monitoring, and reporting information security governance metrics to ensure that organizational objectives are achieved
  Value delivery by optimizing information security investments in support of organizational objectives