Enterprise Security Governance; A practical guide to implement and control Information Security Governance (ISG)

Following the advances of Information Technology (IT) Management and Information Security, organizations have felt the need to standardize their activities and, principally, to integrate any technological action with short and long-term business objectives and administrative strategies. Through the interrelationship of corporative and technological governance, with Information Security Governance (ISG), it becomes possible to reach this alignment, contributing to corporative results. The purpose of this paper is to present a framework for implementing Information Security Governance, which considers the integration between strategical objectives and their indicators - Balanced Scorecard (BSC) - with IT business objectives from CobiT, as well as security best practices from ISO/IEC 17799.