Cybersecurity governance for a business without a security department

A security recommendation lands in your inbox. It makes sense, but it needs a budget, a change to the way people work and someone to approve an exception. Three months later, it is still waiting.

The recommendation needs a decision. Someone has to approve the cost, arrange the change and check that it gets done.

For a smaller organization, cybersecurity governance can start with a business owner, an operations manager and an IT adviser sitting down regularly. Keep a record of the decisions and who is responsible for carrying them out.

Give someone the authority to decide

Your IT provider can explain a weakness and recommend a fix. Management still needs to decide whether the business can tolerate the disruption, approve the cost and accept any risk that remains.

The Canadian Centre for Cyber Security recommends identifying a person in leadership who is responsible for IT security in its baseline guidance for smaller organizations. In practice, name that person and make sure they know which decisions are theirs.

Also identify who can stand in when they are away. An urgent decision should not depend on finding one person on vacation.

Discuss the work the business depends on

Start the conversation with payroll, client records, scheduling, production or another activity people understand. Ask what would happen if that activity stopped, its information became unreliable or someone accessed it without permission.

An accounting firm approaching a filing deadline might put document-system reliability ahead of a fault in a rarely used application. The deadline changes the priority; a technical rating alone will not tell you that.

Keep a short decision record

Use a shared document or register that the right people can access. For each significant issue, record:

• The business activity and the problem affecting it.
• The proposed response, its cost and any disruption.
• The person who approved the decision.
• The owner and target date for the work.
• Any remaining risk and when it will be reconsidered.

If you defer a change, write down why and set a review date. Otherwise, a temporary exception can become a permanent arrangement without anyone choosing it.

Make the meeting small enough to keep

Try a monthly half-hour meeting as a starting point. Review overdue work, significant changes and decisions that need approval. Bring evidence of completed work where it matters. An urgent incident or major business change should trigger a separate conversation rather than wait for the next meeting.

Review changes since the last meeting, overdue work and decisions awaiting approval. Before finishing, confirm who is doing what.

Choose an outstanding security issue and put it through this process. You will quickly see whether the obstacle is missing information, unclear authority, cost or available time. That tells you what to fix in the process itself.

Give your security decisions a clear owner

We work with management to set security priorities, assign responsibilities and review progress. Bring the decision that keeps getting postponed.

Talk with us about security governance →