Who is in charge of the data?
A school loses a memory stick. It holds names and addresses of 300 pupils.
Who must report it? Who decides how long old records are kept? Who checks the rules were followed?
If nobody knows, the school is in trouble before the stick is even found. Today you learn how an organisation avoids this.
Key words
| Word | What it means | Example |
|---|---|---|
| Governance | How a group is run, with clear rules and people in charge. | |
| Information security governance | Governance for keeping data safe. | |
| Framework | A ready-made set of rules and steps. | |
| Data controller | The one who decides why and how personal data is used. | |
| Data processor | The one who handles personal data for a controller, on its orders. | |
| Policy | A written rule that everyone follows. | Passwords must have 12 characters. |
| Data retention | How long data is kept before it is deleted. | |
| Compliance | Following the laws and rules that apply. | |
| Freedom of information request | A request to a public body for the information it holds. Short form: FOI request. | |
| Personal data | Facts about a real person who can be named from them. |
The cells students fill in are left blank in this preview.
By the end of this lesson
Note
I can explain why a company has information security governance and give an example of each of its four purposes.
Starter: what you already know
Have a go
Starter: what you already know
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
What governance is
Governance is how a group is run. Somebody senior sets the rules and checks them.
Information security governance does this for data and systems. It turns "be careful" into clear jobs, written rules and checks.
It has four purposes. Each has an example.
Purpose 1: find, control, tell and report
Governance finds the cyber risks. This is investigate. It adds a control for each risk. This is control.
Then it communicates the risks to staff in plain words. It reports them to leaders, so they can decide what to spend.
Example: a monthly report says "12 laptops need updates". The bosses can then act.
Purpose 2: a framework for roles and rules
A framework says who does what, which rules apply and which jobs happen.
Roles: the data controller decides why data is collected. The data processor handles it for the controller.
Policies: a data retention policy says how long records are kept. A deletion policy says how they are destroyed.
Activities: a new system is checked for risk before anybody buys it.
Check: purposes 1 and 2
Have a go
Check: purposes 1 and 2
4 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.