What is Governance?¶
What you'll be able to do in this chapter
- Define governance and distinguish it cleanly from management.
- Name what governance produces: direction, authority, ownership, accountability, oversight.
- Spot the governance gap at Scaldimet and why it matters.
The setting that nobody controls¶
On your second day at Scaldimet, you ask a simple question: who is responsible for the security of the factory-control systems in France? The answer comes back in fragments. The plant manager says the engineers handle the machines. The engineers say they keep the line running and call the contractor when something breaks. The contractor says they do what they are asked. The head of IT at the Belgian headquarters says, carefully, that the French factory systems "aren't really ours."
So: who is responsible? Everyone touches it. No one owns it. No one sets the rules for it, no one is accountable when it fails, and no one has the authority to decide what should change. This is not a technology problem. It is a governance problem (and it is the most common, most underestimated problem a new CISO inherits).
Governance is about decisions, not doing¶
Here is the definition, then we will pull it apart:
Governance is the system by which an organisation is directed and held accountable. In security terms: it sets the objectives, decides who has the authority to make which decisions, assigns ownership, and oversees whether the objectives are being met.
The crucial word is directed, not done. Governance does not patch the server, write the code, or run the audit. It decides what we are trying to achieve, who is allowed to decide, who owns what, and how we will know if it is working. Then it holds people accountable for the doing.
The cleanest way to grasp governance is to contrast it with management, because the two are constantly confused.
| Governance | Management | |
|---|---|---|
| Question it answers | Are we doing the right things, and who answers for them? | Are we doing things right? |
| Concerned with | Direction, authority, accountability, oversight | Execution, operations, delivery |
| Time horizon | Longer; sets the frame | Day-to-day within the frame |
| Scaldimet example | The board decides cybersecurity is a strategic priority and assigns the CISO the mandate | The CISO's team rolls out multi-factor login across Site Alpha |
| Failure looks like | Nobody owns the French factory systems | The rollout is late or misconfigured |
A way to hold it: Governance sets direction and accountability; management carries out the work. Both are essential and a good organisation needs both, but they are different jobs, and confusing them is itself a governance failure. When a CISO spends all day rowing (operations) and never steering (direction and accountability), the programme drifts (busy but unguided).
Who does the governing¶
You will meet three terms throughout this course, and it is worth separating them now, lightly. The CISO is the person ultimately accountable for security. Their exact remit varies by company: in a firm Scaldimet's size, one CISO often both runs operational teams (say, monitoring, or identity and access) and owns the oversight, while in a larger one the CISO may oversee only. The GRC function (led by a GRC manager) is the oversight part specifically: it sets policy, checks compliance, and challenges, without running the systems day-to-day. That oversight is the main subject of this course. GRC experts are the specialists inside it: a risk analyst, a compliance lead, a policy author.
We will mostly just say "the CISO" for the leader and "the GRC function" for the oversight work, and we will name a specific role only when the distinction actually changes something (for instance, when we define a mandate in Module 2, where it matters a great deal which line the work sits on). Do not over-think the labels; the work is what counts.
What governance actually produces¶
If governance is so abstract, what does it leave behind that you can point to? Five things. These are the outputs of good governance, and you will recognise their absence at Scaldimet immediately.
Direction. A clear statement of what security is for and where it is going (a strategy, objectives, a stated risk appetite). At Scaldimet: none exists yet. There has never been a CISO to set it.
Authority (mandate). A defined right to make certain decisions and require certain actions. Without it, a CISO can only advise and hope. At Scaldimet: you need a mandate from the top, whether granted by the board or by the CEO and executive committee, that reaches into the factories (including the ones that have never answered to anyone but their plant manager).
Ownership. A named owner accountable for each asset, risk and decision. Not "the team" (a person). At Scaldimet: the French factory systems have no owner. That single gap is the root of much of what follows.
Accountability. A clear answer to "who answers when this fails?" (backed by real consequence). At Scaldimet: today, the answer for an OT incident is "nobody in particular." Module 6 shows the law now pushing this accountability all the way up to the board.
Oversight. A way to check that the direction is being followed and the objectives met (reporting, committees, review). At Scaldimet: there is no committee, no report, no review of security at all.
Scaldimet's governance gap, in one line
Scaldimet has plenty of security activity in places (the modern Belgian site patches its systems, runs antivirus, manages identities). What it has no governance: no direction, no CISO mandate that reaches the factories, no named owners for the French OT systems, no accountability when they fail, and no oversight of any of it. Activity without governance is exactly the first manufacturer from Lesson 0.1.B: busy, and defenceless when it matters.
Why ownership matters¶
Of the five outputs, ownership enables the other governance activities to function effectively.
You cannot hold someone accountable for a system nobody owns. You cannot set meaningful direction for an asset whose value nobody has claimed. You cannot oversee work that has no responsible name attached. The reason Scaldimet's French factory systems present a governance gap is that no one owns them (and so every other governance output collapses around that absence). The engineers won't accept rules they didn't agree to follow; the IT head won't answer for systems he says aren't his; the board has never been asked to care.
This is why one of your earliest real moves as a CISO is rarely technical. It is to get a named owner assigned to each significant system. A person, senior enough to be accountable, who agrees (or is required) to answer for it. It feels like bureaucracy. It is actually the load-bearing beam. Module 2 is largely the engineering of this.
Application: governance or management?¶
Below are eight activities at Scaldimet. Sort each into governance (steering: direction, authority, ownership, accountability, oversight) or management (rowing, execution and operations). Decide before the debrief; a couple are deliberately on the edge.
- The board formally approves a company security policy.
- An IT technician installs security updates on the Belgian servers.
- The CISO is given written authority to set rules for all factory systems.
- An engineer reboots a control system after a fault.
- A monthly security committee reviews progress against objectives.
- A named director is made accountable for the French site's cyber risk.
- The team configures multi-factor login for email.
- The CISO defines the company's tolerance for production downtime.
Debrief. Governance: 1 (sets direction and is an act of approval/oversight), 3 (grants authority), 5 (oversight), 6 (assigns ownership/accountability), 8 (sets direction, risk appetite). Management: 2, 4, 7 (all execution). The edge cases are worth the argument: rolling out multi-factor login (7) is management, but deciding it is mandatory company-wide would be governance. The same topic can sit in either box depending on whether you are deciding it or doing it. And a frequent mistake is for a CISO to keep doing (7) and never get round to deciding and overseeing (1, 3, 5, 6, 8). The doing feels productive; the steering is what actually changes the organisation.
Key takeaway
Governance is the system that directs security and holds people accountable: it steers, while management rows. Its outputs are direction, authority, ownership, accountability and oversight. Scaldimet has security activity in places but almost no governance, and the sharpest symptom is that no one owns the French factory systems. Ownership is a prerequisite for accountability, direction and oversight. Your earliest real work as a CISO is governance, not technology.