ISO/IEC FDIS 27014

• Abstract:

  This document provides guidance on concepts, objectives and processes for the governance of information security, by which organizations can evaluate, direct, monitor and communicate the information security-related processes within the organization. The intended audience for this document is: — governing body and top management; — those who are responsible for evaluating, directing and monitoring an information security management system (ISMS) based on ISO/IEC 27001; — those responsible for information security management that takes place outside the scope of an ISMS based on ISO/IEC 27001, but within the scope of governance. This document is applicable to all types and sizes of organizations. All references to an ISMS in this document apply to an ISMS based on ISO/IEC 27001. This document focuses on the three types of ISMS organizations given in Annex B. However, this document can also be used by other types of organizations.

• Status: Not Published
• ICS: 35.030 - IT Security
• Technical Committee: ISO/IEC JTC 1/SC 27 - Information security, cybersecurity and privacy protection
• Drafting Committee: ISO/IEC JTC 1/SC 27/WG 1 - Information security management systems
• Current Stage: 5060 - Close of voting Proof returned by Secretariat
• Start Date: 12-Aug-2026
• Completion Date: 11-Aug-2026

• Revises: ISO/IEC 27014:2020 - Information security, cybersecurity and privacy protection — Governance of information security
• Effective Date: 28-Mar-2026

ISO/IEC FDIS 27014 is an ISO/IEC final draft International Standard on governance of information security. It gives guidance to governing bodies, top management, and ISMS managers on how to evaluate, direct, monitor, and communicate information security-related processes within an organization. The document is written for organizations using an ISO/IEC 27001-based Information Security Management System (ISMS), but it is also stated to apply to organizations of all types and sizes.

What does ISO/IEC FDIS 27014 specify?

ISO/IEC FDIS 27014 specifies guidance for the governance of information security, not a control catalogue or a certification scheme. It explains how organizations can use governance processes to align information security with entity objectives, risk management, compliance obligations, and reporting.

The document is organized into eight clauses, three annexes, and a bibliography:

• Clause 1 Scope
• Clause 2 Normative references
• Clause 3 Definitions
• Clause 4 Abbreviations
• Clause 5 Use and structure of this Recommendation | International Standard
• Clause 6 Governance and management standards
• Clause 7 Entity governance and information security governance
• Clause 8 The governing body's requirements on the ISMS
• Annexes A to C
• Bibliography

Annexes A to C each cover a different case or support topic:

Annex	What it covers
Annex A	Types of ISMS organization
Annex B	Governance relationship
Annex C	Examples of communication

The scope focuses on concepts, objectives, and processes for governance. It also states that all references to an ISMS apply to an ISMS based on ISO/IEC 27001, and that the document focuses on three ISMS organization types described in Annex A.

What are the key requirements of ISO/IEC FDIS 27014?

ISO/IEC FDIS 27014 is built around governance rather than operational security controls. Its main practical message is that the governing body sets direction and oversight, while top management runs the ISMS in line with that direction.

Governance roles and the four processes

Clause 6 and Clause 7 describe governance of information security as the governing body’s overall direction and control of activities that affect information security. Clause 7.3 organizes this work into four processes: evaluate, direct, monitor, and communicate.

In practice, this means the governing body should not just approve policy once and stop. It should review information security performance, make decisions on strategy and risk, and keep information flowing in both directions.

Entity-wide information security

Clause 7.2.1 says information security objectives should be integrated and entity-wide, with coordination between physical and logical security. Responsibility and accountability should cover the full span of the entity, including information held or transferred by external parties.

For readers, this means security governance should look beyond one department or one system. If suppliers, cloud services, or other external parties handle information, those relationships belong in the governance view.

Risk-based decisions and risk appetite

Clause 7.2.2 requires decisions to be based on compliance obligations and entity-specific risk-based decisions. It links acceptable security to the entity’s risk appetite and calls for consistent information security risk management across the entity.

In practice, this means security priorities should be tied to the organization’s broader risk method, not handled as a separate silo. The document also expects resources for information risk management to be allocated through the security governance process.

Direction for acquisition and change

Clause 7.2.3 says information security risk should be assessed when the organization undertakes new activities such as investment, purchases, mergers, new technology, outsourcing, or supplier contracts. It also connects information security with project management, procurement, financial expenditure, legal and regulatory compliance, and strategic risk management.

That matters when a buyer, project manager, or business owner is planning change. Security should be considered early, because governance is meant to shape acquisition and major decisions, not react after the fact.

Conformance, culture, and performance

Clauses 7.2.4 to 7.2.6 cover conformance with internal and external requirements, a security-positive culture, and security performance. They mention legal and regulatory requirements, contractual requirements, internal commitments, education and awareness, and a performance measurement program that supports monitoring, audit, and improvement.

For readers, this means governance is expected to cover compliance, behavior, and measurement together. The governing body should be able to see whether information security is meeting current and future needs, not just whether individual controls exist.

ISMS structure and governing body requirements

Clause 8 says the governing body should require one or more ISMSs that support entity objectives. It should approve each ISMS, define its scope, provide direction, decide on acceptable residual risk or risk treatment, and provide communication channels and authority for use of those channels.

Clause 8.2 describes three scenarios:

• Type A - the ISMS organization is the whole entity
• Type B - the ISMS organization is part of a larger entity
• Type C - the ISMS organization includes parts of several entities

These scenarios matter because the relationship between the governing body and top management changes with organizational structure, but the governance processes remain the same.

What terms does ISO/IEC FDIS 27014 define?

ISO/IEC FDIS 27014 defines the main governance actors and the ISMS context in Clause 3.

• Entity - an organization and other bodies or parties; the entity has governance authority over the organization.
• Organization - the part of an entity that runs and manages an ISMS.
• Governing body - the person or group accountable for the performance and conformance of the entity.
• Management system - a set of interrelated or interacting elements used to establish policies, objectives, and processes to achieve those objectives.
• Top management - the person or group that directs and controls an organization at the highest level.
• Information Security Management System (ISMS) - the management system used here as the basis for governance activities related to information security.
• IT - Information Technology, used in the abbreviations list and in the governance relationship annex.

Who uses ISO/IEC FDIS 27014?

ISO/IEC FDIS 27014 is intended for governing bodies and top management, especially where information security decisions need board-level or senior management oversight. It is also for people who evaluate, direct, and monitor an ISO/IEC 27001-based ISMS.

It is useful for information security managers, risk managers, compliance teams, internal auditors, and anyone responsible for security activities outside the formal ISMS but still under governance. The annexes make it especially relevant for organizations with one ISMS covering the whole entity, an ISMS within a larger entity, or one ISMS shared across several entities.

It also helps buyers, procurement teams, and project leaders who need to know where governance should influence investment, outsourcing, supplier relationships, and major organizational change.

What changed in ISO/IEC FDIS 27014 from the previous edition?

ISO/IEC FDIS 27014 is the third edition and cancels and replaces ISO/IEC 27014:2020. The foreword states that this edition is a minor revision.

The changes stated in the document are:

• document references were updated to the latest published versions where appropriate
• Annex A and Annex B were reordered to follow the order in which they are first cited in the text
• references to ISO/IEC 27000 were updated to reflect its changed purpose and scope, because it is no longer the authoritative source for terms and definitions

Which standards are used with ISO/IEC FDIS 27014?

ISO/IEC FDIS 27014 names these normative references in Clause 2:

Standard	What it contributes
ISO/IEC 27000	Overview of information security management systems and shared terminology
ISO/IEC 27001	Requirements for an ISMS
ISO/IEC 37000	General guidance on governance of organizations

Clause 6.3 also names ISO/IEC 38500 as a related standard on governance of IT for the organization. That matters because ISO/IEC FDIS 27014 places information security governance alongside broader IT governance, with overlapping governance processes.

What does the ISO/IEC FDIS 27014 document contain?

ISO/IEC FDIS 27014 contains guidance text, definitions, abbreviations, a governance model, and annexes that show different organizational relationships. Clause 7.3 presents the four governance processes, and Clause 8 applies them to ISMS structure and governing body responsibilities.

The document includes Figure 1 on the governance model, Figure A.1 on possible relationships between an entity and its ISMS, Figure B.1 on the relationship between governance of information security and governance of information technology, and Annex C with examples of communication. It also contains explanatory text on how governance links to strategy, risk, compliance, performance reporting, and communication to interested parties.

FINAL DRAFT
International
Standard
ISO/IEC FDIS
ISO/IEC JTC 1/SC 27
Information security, cybersecurity
Secretariat: DIN
and privacy protection —
Voting begins on:
Governance of information security
2026-06-16
Sécurité de l'information, cybersécurité et protection de la vie
Voting terminates on:
privée — Gouvernance de la sécurité de l'information
2026-08-11
RECIPIENTS OF THIS DRAFT ARE INVITED TO SUBMIT,
WITH THEIR COMMENTS, NOTIFICATION OF ANY
RELEVANT PATENT RIGHTS OF WHICH THEY ARE AWARE
AND TO PROVIDE SUPPOR TING DOCUMENTATION.
IN ADDITION TO THEIR EVALUATION AS
BEING ACCEPTABLE FOR INDUSTRIAL, TECHNO­
LOGICAL, COMMERCIAL AND USER PURPOSES, DRAFT
INTERNATIONAL STANDARDS MAY ON OCCASION HAVE
TO BE CONSIDERED IN THE LIGHT OF THEIR POTENTIAL
TO BECOME STAN DARDS TO WHICH REFERENCE MAY BE
MADE IN NATIONAL REGULATIONS.
Reference number
FINAL DRAFT
International
Standard
ISO/IEC FDIS
ISO/IEC JTC 1/SC 27
Information security, cybersecurity
Secretariat: DIN
and privacy protection —
Voting begins on:
Governance of information security
Sécurité de l'information, cybersécurité et protection de la vie
Voting terminates on:
privée — Gouvernance de la sécurité de l'information
RECIPIENTS OF THIS DRAFT ARE INVITED TO SUBMIT,
WITH THEIR COMMENTS, NOTIFICATION OF ANY
RELEVANT PATENT RIGHTS OF WHICH THEY ARE AWARE
AND TO PROVIDE SUPPOR TING DOCUMENTATION.
© ISO/IEC 2026
IN ADDITION TO THEIR EVALUATION AS
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
BEING ACCEPTABLE FOR INDUSTRIAL, TECHNO­
LOGICAL, COMMERCIAL AND USER PURPOSES, DRAFT
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
INTERNATIONAL STANDARDS MAY ON OCCASION HAVE
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
TO BE CONSIDERED IN THE LIGHT OF THEIR POTENTIAL
or ISO’s member body in the country of the requester.
TO BECOME STAN DARDS TO WHICH REFERENCE MAY BE
MADE IN NATIONAL REGULATIONS.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: [phone]
Email: [e-mail]
Website: www.iso.org
Published in Switzerland Reference number
© ISO/IEC 2026 – All rights reserved
ii
Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are members
of ISO or IEC participate in the development of International Standards through technical committees
established by the respective organization to deal with particular fields of technical activity. ISO and IEC
technical committees collaborate in fields of mutual interest. Other international organizations, governmental
and non-governmental, in liaison with ISO and IEC, also take part in the work.
The procedures used to develop this document and those intended for its further maintenance are described
in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types of
document should be noted.
ISO and IEC draw attention to the possibility that the implementation of this document may involve the use of
(a) patent(s). ISO and IEC take no position concerning the evidence, validity or applicability of any claimed
patent rights in respect thereof. As of the date of publication of this document, ISO and IEC had not received
notice of (a) patent(s) which may be required to implement this document. However, implementers are
cautioned that this may not represent the latest information, which may be obtained from the patent database
available at www.iso.org/patents and https://patents.iec.ch. ISO and IEC shall not be held responsible for
identifying any or all such patent rights.
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions
related to conformity assessment, as well as information about ISO's adherence to the World Trade
Organization (WTO) principles in the Technical Barriers to Trade (TBT) see www.iso.org/iso/foreword.html.
In the IEC, see www.iec.ch/understanding-standards.
This document was prepared by ITU-T as ITU-T X.1054 (04/2021) and drafted in accordance with its editorial
rules, in collaboration with Joint Technical Committee ISO/IEC JTC 1, Information technology, Subcommittee
SC 27, Information security, cybersecurity and privacy protection.
This third edition cancels and replaces the second edition (ISO/IEC 27014:2020), of which it constitutes a
minor revision.
The changes are as follows:
— document references have been updated to refer to the latest published versions where appropriate;
— Annex A and Annex B have been reordered to follow the order in which they are first cited in the text;
— references to ISO/IEC 27000 have been updated to reflect the change of purpose and scope of the source
document (it is no longer the authoritative source for terms and definitions).
Any feedback or questions on this document should be directed to the user’s national standards body. A
complete listing of these bodies can be found at www.iso.org/members.html and www.iec.ch/national-
committees.
© ISO/IEC 2026 – All rights reserved
iii
INTERNATIONAL STANDARD ISO/IEC 27014:2026 (E)
RECOMMENDATION ITU-T X.1054
Information security, cybersecurity and privacy
protection – Governance of information security

Summary
Recommendation ITU-T X.1054 | International Standard ISO/IEC 27014 provides guidance on the governance of
information security.
Information security is a key issue for organizations, amplified by rapid advances in attack methodologies and
technologies, and corresponding increased regulatory pressures.
The failure of an organization's information security controls can have many adverse impacts on an organization and its
interested parties including but not limited to the undermining of trust.
Governance of information security is the use of resources to ensure effective implementation of information security, and
provides assurance that:
• directives concerning information security will be followed; and
• the governing body will receive reliable and relevant reporting about information security related activities.
This assists the governing body to make decisions concerning the strategic objectives for the organization by providing
information about information security that may affect these objectives. It also ensures that information security strategy
aligns with the overall objectives of the entity.
Managers and others working in organizations need to understand:
• the governance requirements that affect their work; and
• how to meet governance requirements that require them to take action.

History
*
Edition Recommendation Approval Study Group Unique ID
1.0 ITU-T X.1054 2012-09-07 17 11.1002/1000/11594
2.0 ITU-T X.1054 2021-04-30 17 11.1002/1000/14248

Keywords
Information security, information security governance, information security management, ISMS.

*
To access the Recommendation, type the URL https://handle.itu.int/ in the address field of your web
browser, followed by the Recommendation's unique ID. For example, https://handle.itu.int/11.1002/1000/11830-en.
Rec. ITU-T X.1054 (04/2021)
© ISO/IEC 2026 – All rights reserved
iv
FOREWORD
The International Telecommunication Union (ITU) is the United Nations specialized agency in the field of telecom-
munications, information and communication technologies (ICTs). The ITU Telecommunication Standardization
Sector (ITU-T) is a permanent organ of ITU. ITU-T is responsible for studying technical, operating and tariff
questions and issuing Recommendations on them with a view to standardizing telecommunications on a worldwide
basis.
The World Telecommunication Standardization Assembly (WTSA), which meets every four years, establishes the
topics for study by the ITU-T study groups which, in turn, produce Recommendations on these topics.
The approval of ITU-T Recommendations is covered by the procedure laid down in WTSA Resolution 1.
In some areas of information technology which fall within ITU-T's purview, the necessary standards are prepared on
a collaborative basis with ISO and IEC.

NOTE
In this Recommendation, the expression "Administration" is used for conciseness to indicate both a
telecommunication administration and a recognized operating agency.
Compliance with this Recommendation is voluntary. However, the Recommendation may contain certain mandatory
provisions (to ensure, e.g., interoperability or applicability) and compliance with the Recommendation is achieved
when all of these mandatory provisions are met. The words "shall" or some other obligatory language such as "must"
and the negative equivalents are used to express requirements. The use of such words does not suggest that
compliance with the Recommendation is required of any party.

INTELLECTUAL PROPERTY RIGHTS
ITU draws attention to the possibility that the practice or implementation of this Recommendation may involve the
use of a claimed Intellectual Property Right. ITU takes no position concerning the evidence, validity or applicability
of claimed Intellectual Property Rights, whether asserted by ITU members or others outside of the Recommendation
development process.
As of the date of approval of this Recommendation, ITU had not received notice of intellectual property, protected
by patents/software copyrights, which may be required to implement this Recommendation. However, implementers
are cautioned that this may not represent the latest information and are therefore strongly urged to consult the
appropriate ITU-T databases available via the ITU-T website at https://www.itu.int/ITU-T/ipr/.

 ITU 2022
All rights reserved. No part of this publication may be reproduced, by any means whatsoever, without the prior
written permission of ITU.
Rec. ITU-T X.1054 (04/2021)
© ISO/IEC 2026 – All rights reserved
v
CONTENTS
Page
1 Scope . 1
2 Normative references . 1
3 Definitions. 1
4 Abbreviations . 2
5 Use and structure of this Recommendation | International Standard . 2
6 Governance and management standards . 2
6.1 Overview . 2
6.2 Governance activities within the scope of an ISMS . 3
6.3 Other related standards . 3
6.4 Thread of governance within the organization. 4
7 Entity governance and information security governance . 4
7.1 Overview . 4
7.2 Objectives . 4
7.2.1 Objective 1: Establish integrated comprehensive entity-wide information security . 4
7.2.2 Objective 2: Make decisions using a risk-based approach . 4
7.2.3 Objective 3: Set the direction of acquisition . 4
7.2.4 Objective 4: Ensure conformance with internal and external requirements . 5
7.2.5 Objective 5: Foster a security-positive culture . 5
7.2.6 Objective 6: Ensure the security performance meets current and future requirements of the entity. 5
7.3 Processes . 5
7.3.1 General . 5
7.3.2 Evaluate . 6
7.3.3 Direct . 6
7.3.4 Monitor . 7
7.3.5 Communicate . 7
8 The governing body's requirements on the ISMS . 8
8.1 Organization and ISMS . 8
8.2 Scenarios (see Annex A) . 8
8.2.1 Type A: The ISMS organization is the whole entity . 8
8.2.2 Type B: The ISMS organization forms a part of a larger entity . 9
8.2.3 Type C: The ISMS organization includes parts of several entities . 9
Annex A Types of ISMS organization . 10
Annex B Governance relationship. 11
Annex C Examples of communication . 12
Bibliography . 13

Rec. ITU-T X.1054 (04/2021)
© ISO/IEC 2026 – All rights reserved
vi
Introduction
The International Telecommunication Union (ITU) is the United Nations specialized agency in the field of telecommunications.
The ITU Telecommunication Standardization Sector (ITU-T) is a permanent organ of ITU. ITU-T is responsible for studying
technical, operating, and tariff questions and issuing Recommendations on them with a view to standardizing telecommunications
on a world-wide basis. The World Telecommunication Standardization Assembly (WTSA), which meets every four years,
establishes the topics for study by the ITU-T study groups that, in turn, produce Recommendations on these topics. The approval
of ITU-T Recommendations is covered by the procedure laid down in WTSA Resolution 1. In some areas of information
technology that fall within ITU-T's purview, the necessary standards are prepared on a collaborative basis with ISO and IEC.
ISO (the International Organization for Standardization) and IEC (the International Electro technical Commission) form the
specialized system for worldwide standardization. National bodies that are members of ISO or IEC participate in the development
of Recommendation | International Standards through technical committees established by the respective organization to deal
with particular fields of technical activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other
international organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the work. In the
field of Information security, cybersecurity and privacy protection, ISO and IEC have established a joint technical committee,
ISO/IEC JTC 1.
This Recommendation | International Standard has been drafted in accordance with the rules given in the ISO/IEC Directives,
Part 2.
The main task of the joint technical committee is to prepare this Recommendation | International Standard. Draft
Recommendation | International Standards adopted by the joint technical committee are circulated to national bodies for voting.
Publication as an International Standard requires approval by at least 75% of the national bodies casting a vote.
Attention is drawn to the possibility that some of the elements of this Recommendation | International Standard may be the
subject of patent rights. ITU, ISO or IEC shall not be held responsible for identifying any or all such patent rights.
Rec. ITU-T X.1054 | ISO/IEC 27014 was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology,
Subcommittee SC 27, Information security, cybersecurity and privacy protection, in collaboration with ITU-T SG17.

Rec. ITU-T X.1054 (04/2021)
© ISO/IEC 2026 – All rights reserved
vii
INTERNATIONAL STANDARD
ITU-T RECOMMENDATION
Information Security, Cybersecurity and Privacy
Protection – Governance of Information Security
1 Scope
This Recommendation | International Standard provides guidance on concepts, objectives and processes for the governance of
information security, by which organizations can evaluate, direct, monitor and communicate the information security-related
processes within the organization.
The intended audience for this document is:
• governing body and top management;
• those who are responsible for evaluating, directing and monitoring an information security management system
(ISMS) based on ISO/IEC 27001;
• those responsible for information security management that takes place outside the scope of an ISMS based on
ISO/IEC 27001, but within the scope of governance.
This Recommendation | International Standard is applicable to all types and sizes of organizations.
All references to an ISMS in this document apply to an ISMS based on ISO/IEC 27001.
This Recommendation | International Standard focuses on the three types of ISMS organizations given in Annex A. However, it
can also be used by other types of organizations.
2 Normative references
The following Recommendations and International Standards contain provisions which, through reference in this text, constitute
provisions of this Recommendation | International Standard. At the time of publication, the editions indicated were valid. All
Recommendations and Standards are subject to revision, and parties to agreements based on this Recommendation | International
Standard are encouraged to investigate the possibility of applying the most recent edition of the Recommendations and Standards
listed below. Members of IEC and ISO maintain registers of currently valid International Standards. The Telecommunication
Standardization Bureau of the ITU maintains a list of currently valid ITU-T Recommendations.
– ISO/IEC 27000:in force, Information security, cybersecurity and privacy protection — Information security
management systems — Overview.
– ISO/IEC 27001:in force, Information security, cybersecurity and privacy protection — Information security
management systems – Requirements.
– ISO/IEC 37000:in force, Governance of organizations – Guidance.
3 Definitions
For the purposes of this Recommendation | International Standard, the following terms and definitions apply.
ISO, IEC and ITU maintain terminology databases for use in standardization at the following addresses:
• IEC Electropedia: available at https://www.electropedia.org/
• ISO Online browsing platform: available at https://www.iso.org/obp
• ITU Terms and Definitions: available at https://www.itu.int/go/terminology-database
3.1 entity: Organization (3.2) and other bodies or parties.
NOTE – An entity can be a group of companies, or a single company, or a non for profit company, or other. The entity has governance
authority over the organization. The entity can be identical to the organization, for example in smaller companies.
3.2 organization: That part of an entity (3.1) which runs and manages an ISMS.
3.3 governing body: Person or group of people who are accountable for the performance and conformance of the entity.
Rec. ITU-T X.1054 (04/2021)
© ISO/IEC 2026 – All rights reserved
3.3 management system: set of interrelated or interacting elements of an organization to establish policies and objectives
and processes to achieve those objectives
Note 1 to entry: A management system can address a single discipline or several disciplines.
Note 2 to entry: The system elements include the organization’s structure, roles and responsibilities, planning and operation.
3.4 top management: Person or group of people who directs and controls an organization (3.2) at the highest level.
NOTE 1 – Top management has the power to delegate authority and provide resources within the organization. If the scope of the
management system covers only part of an entity, then top management refers to those who direct and control that part of the entity. In this
situation, top management are accountable to the governing body of the entity. (Source ISO/IEC 9001)
NOTE 2 – Top management reports to the governing body. Depending on the size and resources of the organization, top management can
be the same as the governing body.
NOTE 3 – ISO/IEC 37001 also provides definitions for governing body and top management.
4 Abbreviations
For the purposes of this Recommendation | International Standard, the following abbreviations apply:
ISMS Information Security Management System
IT Information Technology
5 Use and structure of this Recommendation | International Standard
This Recommendation | International Standard describes how information security governance operates within an ISMS based
upon ISO/IEC 27001, and how these activities can relate to other governance activities which operate outside the scope of an
ISMS. It outlines four main processes of "evaluate", "direct", "monitor" and "communicate" in which an ISMS can be structured
inside an organization, and suggests approaches for integrating information security governance into organizational governance
activities in each of these processes. Finally, Annex B describes the relationships between organizational governance, governance
of information technology and governance of information security.
The ISMS covers the whole of the organization, by definition (see ISO/IEC 27000). It can cover the whole of the entity, or part
of the entity. This is illustrated in Figure A.1.
6 Governance and management standards
6.1 Overview
Governance of information security is the means by which an organization's governing body provides overall direction and
control of activities that affect the security of an organization's information. This direction and control focuses on circumstances
where inadequate information security can adversely affect the organization's ability to achieve its overall objectives. It is
common for a governing body to realise its governance objectives by:
• providing direction by setting strategies and policies;
• monitoring the performance of the organization; and
• evaluating proposals and plans developed by managers.
Management of information security is associated with ensuring the achievement of the objectives of the organization described
within the strategies and policies established by the governing body. This can include interacting with the governing body by:
• providing proposals and plans for consideration by the governing body; and
• providing information to the governing body concerning the performance of the organization.
Effective governance of information security requires both members of the governing body and managers to fulfil their respective
roles in a consistent way.
Rec. ITU-T X.1054 (04/2021)
© ISO/IEC 2026 – All rights reserved
6.2 Governance activities within the scope of an ISMS
ISO/IEC 27001 specifies the requirements for establishing, implementing, maintaining and continually improving an information
security management system within the context of an organization. It also includes requirements for the assessment and treatment
of information security risks tailored to the needs of the organization.
ISO/IEC 27001 does not use the term "governance" but specifies a number of requirements which are governance activities. The
following list provides examples of these activities. References to the organization and top management are, as previously noted,
associated with the scope of an ISMS based on ISO/IEC 27001.
• ISO/IEC 27001:2022, 4.1 requires the organization to identify what it is aiming to achieve – its information
security goals and objectives. These should be related to, and support, the overall goals and objectives of the
entity. This relates to governance objectives 1, 3 and 4 stated in 7.2 of this Recommendation | International
Standard.
• ISO/IEC 27001:2022, 4.2 requires the organization to identify the interested parties that are relevant to its ISMS,
and the requirements of those interested parties relevant to information security. This relates to governance
objective 4 stated in 7.2 of this Recommendation | International Standard.
• ISO/IEC 27001:2022, 4.3 requires the organization to define the boundaries and applicability of the ISMS to
establish its scope by considering the external issues and internal issues, the requirements, and interfaces and
dependencies. It is also specified that the organization shall build the requirements and expectations of interested
...