From your POV, what’s the current state of your resources/funding for data security governance efforts, overall?

Security Strategy & RoadmapData Privacy & Protection

Excellent (more than enough)9%

Good (we have enough to reach our goals)52%

Acceptable (could be better but we make do)36%

Poor/unacceptable (more funding needed ASAP)3%

Unsure / other

75 PARTICIPANTS
423 viewscircle icon1 Comment
Sort by:
Group Director of Information Security in Bankinga year ago

Efforts in undertaking Data Security Governance would be an endless pit in places where operationalisation duties are embedded within the teams tasked with creating the governance models. 
If the tasks of governance and operations are segregated, funding can be contained. 

Data security governance should only have the following goals:
1. Define framework for Data Classification (automation preferred)
2. Define objectives for protecting classified data against data loss through automation tools (regulatory references if applicable).
3. Define risk appetite and advise ways to leverage data for business purposes (organisations need to do marketing, create analytics, share with 3rd party MSPs etc.)
4. Ensure compliance to 1,2,& 3

Post defining this governing framework, let the operational costs, especially those of licensing and monitoring, be managed by any other team outside of GRC. GRC should enter the scene bi-annually to ensure compliance to the framework.

Lightbulb on1

Content you might like

What’s your “hot take” when it comes to security questionnaires?

Does your current cybersecurity governance structure include supply chain risk management?

Yes46%

We’re updating cyber governance structure to include it39%

No13%

Other/show results3%

View Results

How are you currently managing SIEM costs? Have you found effective ways to actually reduce storage costs for your SIEM?

Read More Comments

As part of our NYSE IPO prep, we’re debating how to communicate our system hardening efforts in regulatory disclosures (e.g., SEC Form 20-F, SFC).

Would you recommend sharing % compliance (e.g., “85% CIS Tier 2”) or sticking to qualitative descriptions of how we identify and mitigate risks? Also, do SFC/ISO 27001 expectations require full ISMS integration, or is a % model acceptable?