Simple explanation
Governance is the "who decides, and how" layer above individual security controls — the guidelines, policies, standards, and procedures that give the whole security program structure and accountability.
Technical explanation
Guidelines — recommended, not mandatory, best practices.
Policies — formal, mandatory statements of intent. Common examples: AUP (Acceptable Use Policy), information security policy, BCP (Business Continuity Policy), incident response policy, SDLC (Software Development Life Cycle) policy, and change management policy.
Standards — specific, mandatory requirements that implement a policy (a password standard specifying exact length/complexity requirements, an access control standard, a physical security standard, an encryption standard specifying which algorithms are approved).
Procedures — step-by-step instructions for carrying out a standard (change management procedures, onboarding/offboarding procedures, incident response playbooks).
External considerations shaping all of the above: regulatory requirements, legal obligations, industry-specific standards, and jurisdiction — local, regional, national, and global.
Monitoring and revision — governance documents aren't "set and forget"; they need periodic review as the organization, threats, and regulations change.
Governance structures: boards, committees, government entities, and whether governance is centralized (one authority) or decentralized (distributed across business units).
Roles and responsibilities for systems and data: owners (accountable for the asset overall), controllers (determine why/how data is processed — a GDPR-specific term), processors (process data on behalf of a controller), custodians/stewards (day-to-day operational responsibility for protecting the data, without necessarily owning the decision-making).
Synonyms / related terms
| Term | Means | |---|---| | AUP | Acceptable Use Policy | | SDLC | Software Development Life Cycle | | Data steward | Often used interchangeably with data custodian |
Concept Check
"A company requires all passwords to be at least 14 characters. Is this a policy or a standard?" It's a standard — a policy would state the intent ("passwords must be strong enough to resist common attacks"), while the standard supplies the specific, measurable requirement (14 characters) that implements that intent.
Interview-style Q&A
Q: What's the practical difference between a data controller and a data processor? A: "The controller decides why data is being collected and how it will be used — they set the purpose. The processor acts on the controller's instructions to actually handle the data, but doesn't independently decide its purpose. A payroll company processing employee data on behalf of a client is a processor; the client, who decided to collect that data and for what reason, is the controller."
Memory trick
"Guidelines suggest, Policies require, Standards specify, Procedures instruct" — the four governance document types, from most to least abstract, each word matched to its function.