Policies, Standards and Governance Frameworks

Organisations manage information security through a layered structure of policies, standards, procedures and guidelines. Each layer serves a different purpose and reaches a different audience. Understanding the difference between these layers, and where your responsibilities sit within them, is an important part of managing your team’s security obligations effectively.

The Policy Hierarchy

Most organisations structure their information security documentation in a hierarchy that moves from broad, strategic statements at the top to specific, operational instructions at the bottom. The four main levels are:

• Policies: high-level statements of intent that set out an organisation’s overall approach to a particular area of security. An information security policy, for example, will typically state that all employees are responsible for protecting organisational data, that access to systems should be limited to what is necessary for each individual’s role, and that security incidents must be reported promptly. Policies are usually approved at senior leadership or board level and apply to the whole organisation. They do not contain detailed instructions; they establish the principles and expectations that all other documentation must support.
• Standards: more specific documents that define the minimum requirements for a particular area of security, translating policy intent into measurable requirements. A password standard, for example, might specify a minimum length of twelve characters, require a combination of letters, numbers and symbols, prohibit the reuse of the last ten passwords, and mandate a change every ninety days. Standards remove ambiguity: they tell staff and managers exactly what is required, leaving no room for different interpretations.
• Procedures: step-by-step instructions for carrying out specific tasks securely. A procedure for granting a new employee access to systems might specify exactly which systems they should be given access to, who must approve each access request, how the request is logged, and how access is reviewed when the employee changes roles or leaves the organisation. Procedures are the operational heart of an ISMS: they are what turns policy intent into consistent, repeatable practice.
• Guidelines: recommended approaches that provide additional context and support for good security decision-making but are not mandatory. Guidelines help staff understand the spirit behind policies and make sensible security decisions in situations that procedures do not explicitly cover. For example, a guideline on working in public spaces might advise staff to use a privacy screen on their laptop, sit with their back to a wall, and avoid conducting sensitive conversations in areas where they might be overheard.

What This Means for You as a Manager

Your role in this hierarchy is primarily at the procedures and guidelines level. You are unlikely to write your organisation’s information security policy, but you are responsible for ensuring your team understands and follows the procedures that apply to their work. You are also well placed to identify when procedures are unclear, outdated or not followed in practice, and to escalate those observations to the appropriate team.

A common failure mode in organisations is the existence of policies and procedures that look thorough on paper but bear little relationship to how work actually gets done. The gap between documented security requirements and real-world behaviour is often visible to managers before it becomes visible to auditors or security teams. Closing that gap is one of the most valuable contributions a security-aware manager can make.

Governance Frameworks

Beyond an organisation’s own internal policies, a range of internationally recognised governance frameworks provide structure, credibility and a common reference point for information security management. Two of the most significant globally are ISO/IEC 27001 and the NIST Cybersecurity Framework.

ISO/IEC 27001:2022: The International Standard

ISO/IEC 27001:2022 is the global benchmark for information security management. It takes a risk-based approach, requiring organisations to identify their information assets, assess the risks to those assets, and implement a set of controls proportionate to those risks. It is structured around the Plan-Do-Check-Act cycle, a management principle used across many disciplines that emphasises continuous improvement rather than one-off compliance.

Annex A of the standard provides a catalogue of 93 security controls, grouped into four categories: organisational controls, people controls, physical controls and technological controls. Organisations do not implement all 93 controls; instead, they select those relevant to their risk profile and document their rationale for excluding others. This flexibility makes the standard applicable to a small charity with ten employees and a global bank with tens of thousands of staff.

The standard explicitly requires leadership commitment. Senior managers must demonstrate that they are actively engaged with the ISMS, that they have allocated adequate resources to it, and that they are setting a clear tone about the importance of information security across the organisation. This is not a technical requirement; it is a management requirement, and it reflects the understanding that security programmes without visible leadership support tend to be ineffective.

NIST Cybersecurity Framework 2.0

The National Institute of Standards and Technology Cybersecurity Framework, updated to version 2.0 in February 2024, is a widely used framework particularly prominent in the United States and increasingly adopted by organisations operating globally. Unlike ISO 27001, it does not lead to a formal certification but provides a flexible, adaptable structure that organisations can use to understand, assess and improve their cyber security posture.

CSF 2.0 organises cybersecurity activities into six core functions: Govern, Identify, Protect, Detect, Respond and Recover. The most significant addition in the 2024 update is the Govern function, which sits at the centre of the framework and oversees all the others. The Govern function covers the establishment and monitoring of an organisation’s cybersecurity risk management strategy, expectations and policy. Its introduction reflects a global recognition that effective cyber security is fundamentally a governance and leadership challenge, not a technical one.

NIST describes the CSF as being particularly useful for fostering communication at all levels of an organisation, from the board and chief executive through to middle management and those carrying out day-to-day security responsibilities. For mid-level managers, this is directly relevant: you are one of the key communication links in that chain, translating strategic intent into operational practice and escalating operational concerns to strategic decision-makers.

The Manager’s Role in Governance

Governance frameworks are most effective when they are understood and actively supported throughout the management hierarchy, not just at the top. Senior leaders set the tone and allocate resources. IT and security teams design and implement technical controls. Mid-level managers are the critical connective tissue: they translate policy into practice, model expected behaviours in their own daily work, monitor their team’s adherence to security procedures, and create the conditions in which their teams can and will act securely.

A manager who understands the governance framework their organisation uses is better placed to ask the right questions when a new project is proposed, make proportionate security decisions when procedures do not cover every situation, and escalate concerns through the appropriate channels when they observe gaps or risks. You do not need to have read every clause of ISO 27001 to fulfil this role effectively. You do need to understand the principles behind it.