Task force: Infosec must be part of corporate governance

Share this article:

A task force of the National Cyber Security Partnership (NCSP) Monday released its recommendations for organizations to incorporate cybersecurity into their corporate governance systems.

"This is not a technology, CIO, or chief security officer issue," Bill Conner, co-chair of the task force and president and CEO of Entrust, said in a media conference call. "The issue is a corporate governance, board level and CEO issue."

The group said infosec governance needs to be voluntary instead of mandated by government. To that end, it urged companies of all sizes to adopt the infosec governance framework it developed and indicate on their web sites their commitment to infosec governance. The task force also developed a "core set of principals" to help organizations develop infosec governance programs.

In addition, the group recommended that the Committee of Sponsoring Organizations of the Treadway Commission (COSO) revise the Internal Controls-Integrated Framework so it clearly addresses infosec.

"We want to make it clear that the leaders of organizations today already have a fiduciary responsiblity to have strong information security," said Art Coviello, task force co-chair and president and CEO of RSA Security.

The recommendations from the NCSP's Corporate Governance Task Force are the latest from the NCSP, which is a coalition of business and technology groups. Other NCSP task forces previously released recommendations on improving software security, security awareness, and developing early warning systems.


Share this article:

Next Article in News

Sign up to our newsletters

More in News

Research shows vulnerabilities go unfixed longer in ASP

Research shows vulnerabilities go unfixed longer in ASP

A new report finds little difference in the number of vulnerabilities among programming languages, but remediation times vary widely.

Bill would restrict Calif. retailers from storing certain payment data

The bill would ban businesses from storing sensitive payment data, for any long than required, even if it is encrypted.

Amplification, reflection DDoS attacks increase 35 percent in Q1 2014

Amplification, reflection DDoS attacks increase 35 percent in ...

The Q1 2014 Global DDoS Attack Report reveals that amplification and reflection distributed denial-of-service attacks are on the rise.