Scope Enterprise Active

Governance

To establish, oversee, and continually improve the organization's security, privacy, and resilience program.

Domain ID
DOM-001
Domain Code
GOV
Business Owner
Board / CISO

Domain Overview

GOV · Full Domain Profile
Short Overview

Establishes the foundational structures, processes, and accountabilities for information security and privacy oversight, defining how security decisions are made and how the security program is directed, monitored, and continuously improved.

Description

Governs the overall program, including executive sponsorship, resource allocation, roles and responsibilities, and the integration of security into business strategy.

Why This Domain Matters

Without strong governance, security becomes reactive, fragmented, and misaligned with business priorities, leading to wasted investments, regulatory penalties, and increased risk exposure.

Business Objectives

    Business Risks

      Common Challenges

        Key Capabilities

        Stakeholders, Industries & Technologies

        GOV · Operating Context

        Typical Stakeholders

        Applicable Industries

        Applicable Technologies

        Keywords & Tags

        Associated Controls Catalog

        8 Active Controls in Domain
        Control ID Control Name Category & Type Criticality Status Requirements Action
        GOV-001 Information Security Governance Establishes the foundational governance...
        Administrative
        Detective
        		 Critical Active 📋 12 Reqs View →
        GOV-002 Security Charter Creates the foundational governing docum...
        Administrative
        Detective
        		 High Active 📋 12 Reqs View →
        GOV-003 Governance Committees Establishes formal governance committees...
        Administrative
        Preventive
        		 Critical Active 📋 12 Reqs View →
        GOV-004 Executive Oversight & Reporting Establishes processes and reporting fram...
        Administrative
        Detective
        		 High Active 📋 12 Reqs View →
        GOV-005 Information Security Program Management Establishes program management capabilit...
        Administrative
        Detective
        		 High Active 📋 12 Reqs View →
        GOV-006 Security Program Continuous Improvement Establishes a structured continuous impr...
        Administrative
        Corrective
        		 High Active 📋 12 Reqs View →
        GOV-007 Security Integration into Business & Technology Initiatives Establishes processes to embed security,...
        Administrative
        Preventive
        		 High Active 📋 12 Reqs View →
        GOV-008 Enterprise Control Library Management Establishes a centralized, governed libr...
        Administrative
        Detective
        		 High Active 📋 12 Reqs View →

        Compliance Requirements & Audit Crosswalk

        96 Specific Audit Clauses

        The following requirements dictate specific audit evidence criteria and testing steps mapped directly under the controls of this domain.

        REQUIREMENT ID REQUIREMENT TITLE & DETAILS MAPPED CONTROL TYPICAL OWNER ACTION
        GOV-001-R001 Governance Framework The organization shall establish and mai... GOV-001 Information Security Governanc... CISO, Governance Committee, Board of Directors, Risk Management View ↗
        GOV-001-R002 Governance Charter The organization shall establish and mai... GOV-001 Information Security Governanc... CISO, Board of Directors, CEO, Governance Committee, Legal View ↗
        GOV-001-R003 Governance Principles The organization shall define and docume... GOV-001 Information Security Governanc... CISO, Governance Committee, Privacy Officer, Legal, Executive Leadership View ↗
        GOV-001-R004 Governance Scope The organization shall define and mainta... GOV-001 Information Security Governanc... CISO, Governance Committee, Enterprise Architecture, Asset Owners, Business Unit Leaders View ↗
        GOV-001-R005 Governance Authority The organization shall establish a forma... GOV-001 Information Security Governanc... CISO, Board of Directors, CEO, Legal View ↗
        GOV-001-R006 Governance Accountability The organization shall assign accountabi... GOV-001 Information Security Governanc... CISO, CEO, Board of Directors, Compliance Committee, Risk Committee View ↗
        GOV-001-R007 Governance Decision-Making The organization shall maintain formal d... GOV-001 Information Security Governanc... CISO, Governance Committee, Risk Committee, Compliance, Legal View ↗
        GOV-001-R008 Governance Oversight The organization shall implement formal... GOV-001 Information Security Governanc... Board of Directors, Audit Committee, Risk Committee, CISO, Independent Advisors View ↗
        GOV-001-R009 Governance Performance The organization shall measure the effec... GOV-001 Information Security Governanc... CISO, Governance Committee, Board of Directors, Audit Committee View ↗
        GOV-001-R010 Governance Review The organization shall periodically revi... GOV-001 Information Security Governanc... CISO, Internal Audit, Board of Directors, Governance Committee View ↗
        GOV-001-R011 Governance Reporting The organization shall provide timely an... GOV-001 Information Security Governanc... CISO, Board of Directors, Executive Leadership, Audit Committee View ↗
        GOV-001-R012 Governance Continuous Improvement The organization shall drive ongoing enh... GOV-001 Information Security Governanc... CISO, Governance Committee, Internal Audit, Risk Management View ↗
        GOV-002-R001 Charter Establishment The organization shall establish a forma... GOV-002 Security Charter CISO, CEO, Board of Directors, Legal, Compliance View ↗
        GOV-002-R002 Charter Purpose The Information Security Charter shall c... GOV-002 Security Charter CISO, CEO, Board of Directors, Communications View ↗
        GOV-002-R003 Charter Scope The Information Security Charter shall d... GOV-002 Security Charter CISO, CEO, Legal, Business Unit Leaders View ↗
        GOV-002-R004 Charter Authority The Information Security Charter shall a... GOV-002 Security Charter CISO, Board of Directors, CEO, Legal View ↗
        GOV-002-R005 Charter Governance Mandate The Information Security Charter shall d... GOV-002 Security Charter CISO, Board of Directors, Governance Committee, Risk Committee View ↗
        GOV-002-R006 Charter Executive Sponsorship The Information Security Charter shall b... GOV-002 Security Charter CEO, CISO, Board of Directors View ↗
        GOV-002-R007 Charter Approval The Information Security Charter shall b... GOV-002 Security Charter Board of Directors, CEO, CISO View ↗
        GOV-002-R008 Charter Communication The organization shall communicate the I... GOV-002 Security Charter CISO, Communications, HR, Legal, Compliance View ↗
        GOV-002-R009 Charter Accessibility The organization shall ensure the Inform... GOV-002 Security Charter CISO, IT Operations, Legal, Compliance View ↗
        GOV-002-R010 Charter Review The organization shall periodically revi... GOV-002 Security Charter CISO, Board of Directors, Legal, Compliance View ↗
        GOV-002-R011 Charter Maintenance The organization shall maintain the Info... GOV-002 Security Charter CISO, Legal, Compliance, Board of Directors View ↗
        GOV-002-R012 Charter Alignment The organization shall ensure the Inform... GOV-002 Security Charter CISO, Legal, Corporate Governance, Board of Directors View ↗
        GOV-003-R001 Committee Establishment The organization shall establish formal... GOV-003 Governance Committees CISO, Executive Leadership, Board of Directors, Business Unit Leaders View ↗
        GOV-003-R002 Committee Charter The organization shall develop and maint... GOV-003 Governance Committees Committee Chair, CISO, Governance Committee View ↗
        GOV-003-R003 Committee Scope The charter for each governance committe... GOV-003 Governance Committees Committee Chair, CISO, Governance Committee View ↗
        GOV-003-R004 Committee Membership The organization shall define and docume... GOV-003 Governance Committees CISO, Governance Committee, Human Resources View ↗
        GOV-003-R005 Committee Roles and Authority The organization shall clearly define th... GOV-003 Governance Committees Committee Chair, CISO, Governance Committee View ↗
        GOV-003-R006 Committee Meeting Management The organization shall establish effecti... GOV-003 Governance Committees Committee Chair, Committee Secretary, CISO View ↗
        GOV-003-R007 Committee Decision Making The organization shall maintain formal d... GOV-003 Governance Committees Committee Chair, Committee Secretary, CISO View ↗
        GOV-003-R008 Committee Reporting The organization shall ensure each gover... GOV-003 Governance Committees CISO, Committee Secretary, Report Owners View ↗
        GOV-003-R009 Committee Escalation The organization shall establish escalat... GOV-003 Governance Committees Committee Chair, CISO, Executive Leadership, Board of Directors View ↗
        GOV-003-R010 Committee Performance Review The organization shall conduct periodic... GOV-003 Governance Committees Governance Committee, Internal Audit, CISO View ↗
        GOV-003-R011 Committee Records Management The organization shall maintain records... GOV-003 Governance Committees Committee Secretary, Records Management, Legal, CISO View ↗
        GOV-003-R012 Committee Continuous Improvement The organization shall drive ongoing enh... GOV-003 Governance Committees Committee Chair, CISO, Internal Audit View ↗
        GOV-004-R001 Executive Oversight Framework The organization shall establish an exec... GOV-004 Executive Oversight & Reportin... Board of Directors, CEO, CISO, Audit Committee View ↗
        GOV-004-R002 Board Oversight Responsibilities The organization shall define and docume... GOV-004 Executive Oversight & Reportin... Board of Directors, CEO, CISO, Corporate Governance View ↗
        GOV-004-R003 Executive Management Oversight The organization shall define and docume... GOV-004 Executive Oversight & Reportin... CEO, CISO, Executive Leadership, Audit Committee View ↗
        GOV-004-R004 Governance Review Meetings The organization shall conduct regular g... GOV-004 Executive Oversight & Reportin... Board of Directors, CEO, CISO, Audit Committee View ↗
        GOV-004-R005 Executive Reporting Framework The organization shall establish an exec... GOV-004 Executive Oversight & Reportin... CISO, Board of Directors, Executive Leadership, Audit Committee View ↗
        GOV-004-R006 Reporting Content and Information Quality The organization shall define content re... GOV-004 Executive Oversight & Reportin... CISO, Board of Directors, Executive Leadership View ↗
        GOV-004-R007 Reporting Frequency and Timeliness The organization shall establish reporti... GOV-004 Executive Oversight & Reportin... CISO, Board of Directors, Executive Leadership View ↗
        GOV-004-R008 Governance Performance Reporting The organization shall provide executive... GOV-004 Executive Oversight & Reportin... CISO, Board of Directors, Executive Leadership, Internal Audit View ↗
        GOV-004-R009 Strategic Risk and Issue Reporting The organization shall provide executive... GOV-004 Executive Oversight & Reportin... CISO, Board of Directors, Risk Committee, Executive Leadership View ↗
        GOV-004-R010 Executive Decision Support The organization shall provide executive... GOV-004 Executive Oversight & Reportin... CISO, Board of Directors, Executive Leadership, Internal Audit View ↗
        GOV-004-R011 Oversight Records and Action Tracking The organization shall maintain comprehe... GOV-004 Executive Oversight & Reportin... CISO, Governance Committee, Records Management View ↗
        GOV-004-R012 Oversight and Reporting Continuous Improvement The organization shall drive ongoing enh... GOV-004 Executive Oversight & Reportin... CISO, Board of Directors, Executive Leadership View ↗
        GOV-005-R001 Program Management Framework The organization shall establish a progr... GOV-005 Information Security Program M... CISO, Security Program Manager, Project Management View ↗
        GOV-005-R002 Program Planning The organization shall conduct formal pl... GOV-005 Information Security Program M... CISO, Security Program Manager, Project Management View ↗
        GOV-005-R003 Program Execution The organization shall execute the infor... GOV-005 Information Security Program M... CISO, Security Program Manager, Project Managers View ↗
        GOV-005-R004 Program Resource Management The organization shall manage resources... GOV-005 Information Security Program M... CISO, Security Program Manager, Human Resources View ↗
        GOV-005-R005 Program Budget Management The organization shall manage the inform... GOV-005 Information Security Program M... CISO, Security Program Manager, Finance View ↗
        GOV-005-R006 Program Staffing The organization shall ensure the inform... GOV-005 Information Security Program M... CISO, Security Program Manager, Human Resources View ↗
        GOV-005-R007 Program Prioritization The organization shall maintain prioriti... GOV-005 Information Security Program M... CISO, Security Program Manager, Risk Management View ↗
        GOV-005-R008 Program Coordination The organization shall maintain coordina... GOV-005 Information Security Program M... CISO, Security Program Manager, Business Unit Leaders View ↗
        GOV-005-R009 Program Dependency Management The organization shall maintain dependen... GOV-005 Information Security Program M... CISO, Security Program Manager, Project Management View ↗
        GOV-005-R010 Program Performance Monitoring The organization shall monitor the perfo... GOV-005 Information Security Program M... CISO, Security Program Manager, Performance Management View ↗
        GOV-005-R011 Program Review The organization shall conduct periodic... GOV-005 Information Security Program M... CISO, Security Program Manager, Internal Audit View ↗
        GOV-005-R012 Program Continuous Improvement The organization shall drive ongoing enh... GOV-005 Information Security Program M... CISO, Security Program Manager, Security Teams View ↗
        GOV-006-R001 Improvement Framework The organization shall establish a conti... GOV-006 Security Program Continuous Im... CISO, Security Program Manager, Quality Management View ↗
        GOV-006-R002 Improvement Identification The organization shall systematically id... GOV-006 Security Program Continuous Im... CISO, Security Program Manager, Security Teams View ↗
        GOV-006-R003 Improvement Prioritization The organization shall prioritize improv... GOV-006 Security Program Continuous Im... CISO, Security Program Manager, Risk Management View ↗
        GOV-006-R004 Improvement Planning The organization shall develop formal pl... GOV-006 Security Program Continuous Im... CISO, Security Program Manager, Project Managers View ↗
        GOV-006-R005 Improvement Approval The organization shall establish approva... GOV-006 Security Program Continuous Im... CISO, Security Program Manager, Governance Committee View ↗
        GOV-006-R006 Improvement Implementation The organization shall implement approve... GOV-006 Security Program Continuous Im... CISO, Security Program Manager, Project Managers View ↗
        GOV-006-R007 Improvement Monitoring The organization shall monitor improveme... GOV-006 Security Program Continuous Im... CISO, Security Program Manager, Project Managers View ↗
        GOV-006-R008 Improvement Measurement The organization shall measure the effec... GOV-006 Security Program Continuous Im... CISO, Security Program Manager, Performance Management View ↗
        GOV-006-R009 Lessons Learned Integration The organization shall capture and integ... GOV-006 Security Program Continuous Im... CISO, Security Program Manager, Incident Response, Audit View ↗
        GOV-006-R010 Improvement Reporting The organization shall report on improve... GOV-006 Security Program Continuous Im... CISO, Security Program Manager, Governance Committee View ↗
        GOV-006-R011 Improvement Review The organization shall conduct periodic... GOV-006 Security Program Continuous Im... CISO, Security Program Manager, Quality Management View ↗
        GOV-006-R012 Improvement Effectiveness The organization shall evaluate the over... GOV-006 Security Program Continuous Im... CISO, Security Program Manager, Internal Audit View ↗
        GOV-007-R001 Integration Framework The organization shall establish a frame... GOV-007 Security Integration into Busi... CISO, Security Architects, IT Leadership, Project Management View ↗
        GOV-007-R002 Business Initiative Integration The organization shall ensure informatio... GOV-007 Security Integration into Busi... CISO, Business Leaders, Security Architects, Project Management View ↗
        GOV-007-R003 Technology Initiative Integration The organization shall ensure informatio... GOV-007 Security Integration into Busi... CISO, IT Leadership, Security Architects, Project Management View ↗
        GOV-007-R004 Security Participation The organization shall ensure the inform... GOV-007 Security Integration into Busi... CISO, Security Architects, IT Leadership, Project Management View ↗
        GOV-007-R005 Planning Integration The organization shall ensure informatio... GOV-007 Security Integration into Busi... CISO, Security Architects, IT Leadership, Project Management View ↗
        GOV-007-R006 Governance Review The organization shall conduct governanc... GOV-007 Security Integration into Busi... CISO, Security Architects, Governance Committee View ↗
        GOV-007-R007 Security Acceptance Criteria The organization shall define and apply... GOV-007 Security Integration into Busi... CISO, Security Architects, IT Leadership, Quality Assurance View ↗
        GOV-007-R008 Integration Monitoring The organization shall monitor the integ... GOV-007 Security Integration into Busi... CISO, Security Architects, Project Management View ↗
        GOV-007-R009 Executive Escalation The organization shall establish escalat... GOV-007 Security Integration into Busi... CISO, Security Architects, Governance Committee View ↗
        GOV-007-R010 Integration Reporting The organization shall report on the int... GOV-007 Security Integration into Busi... CISO, Security Architects, Governance Committee View ↗
        GOV-007-R011 Integration Review The organization shall conduct periodic... GOV-007 Security Integration into Busi... CISO, Security Architects, IT Leadership View ↗
        GOV-007-R012 Integration Continuous Improvement The organization shall drive ongoing enh... GOV-007 Security Integration into Busi... CISO, Security Architects, IT Leadership View ↗
        GOV-008-R001 Control Library Framework The organization shall establish a frame... GOV-008 Enterprise Control Library Man... CISO, Control Owners, Compliance, Security Architects View ↗
        GOV-008-R002 Control Definition Standards The organization shall establish definit... GOV-008 Enterprise Control Library Man... CISO, Control Owners, Compliance, Security Architects View ↗
        GOV-008-R003 Control Classification The organization shall establish classif... GOV-008 Enterprise Control Library Man... CISO, Control Owners, Compliance, Security Architects View ↗
        GOV-008-R004 Control Ownership The organization shall assign explicit o... GOV-008 Enterprise Control Library Man... CISO, Control Owners, Compliance View ↗
        GOV-008-R005 Control Change Management The organization shall maintain change g... GOV-008 Enterprise Control Library Man... CISO, Control Owners, Compliance, Governance Committee View ↗
        GOV-008-R006 Control Lifecycle Management The organization shall maintain lifecycl... GOV-008 Enterprise Control Library Man... CISO, Control Owners, Compliance View ↗
        GOV-008-R007 Control Relationships The organization shall maintain relation... GOV-008 Enterprise Control Library Man... CISO, Control Owners, Compliance View ↗
        GOV-008-R008 Control Reuse The organization shall promote the reuse... GOV-008 Enterprise Control Library Man... CISO, Control Owners, Compliance View ↗
        GOV-008-R009 Control Quality Management The organization shall maintain quality... GOV-008 Enterprise Control Library Man... CISO, Control Owners, Compliance, Quality Assurance View ↗
        GOV-008-R010 Control Library Review The organization shall conduct periodic... GOV-008 Enterprise Control Library Man... CISO, Control Owners, Compliance, Internal Audit View ↗
        GOV-008-R011 Control Library Reporting The organization shall report on the ent... GOV-008 Enterprise Control Library Man... CISO, Control Owners, Compliance, Governance Committee View ↗
        GOV-008-R012 Control Library Continuous Improvement The organization shall drive ongoing enh... GOV-008 Enterprise Control Library Man... CISO, Control Owners, Compliance View ↗

        Cross-Mapped Regulatory Frameworks

        Harmonized Control Mappings
        Framework Code Framework Name & Description Family / Category Version Action
        COBIT2019 COBIT COBIT is an enterprise governance and ma...
        COBIT
        Governance Framework
        		 v2019 View →
        MAPPED ISO 37000 Crosswalk regulatory baseline mapped under ASPIA UCL. Standard Baseline —
        MAPPED COSO Crosswalk regulatory baseline mapped under ASPIA UCL. Standard Baseline —
        NIST-CSF NIST CSF (Govern) The NIST Cybersecurity Framework provide...
        NIST
        Framework
        		 v2 View →
        MAPPED ISACA Governance Framework Crosswalk regulatory baseline mapped under ASPIA UCL. Standard Baseline —
        MAPPED ISO 38500 Crosswalk regulatory baseline mapped under ASPIA UCL. Standard Baseline —
        MAPPED ISO/IEC 27014 (Governance of Information Security) Crosswalk regulatory baseline mapped under ASPIA UCL. Standard Baseline —