Governance Gains

Learn how to connect good governance with key risk, build an enterprise security program, and more.

Featured Articles

Connecting Good Governance With Key Risk

During the COVID-19 pandemic, many enterprises have stated that employee health and well-being are their primary concern. The events of 2020 have also led organizations to evaluate their preparedness for and responses to another major risk factor...

Additional languages available: Français

ISACA Journal Article

Privacy Risk Management

Author: Andrea Tang

Concerns about privacy risk have triggered a number of new privacy protection regulations: The US State of California Consumer Privacy Act (CCPA) went into effect on 1 January 2020, the Brazilian General Data Protection Law (LGPD) becomes effective in August 2020...

ISACA Journal Article

Digital Governance: Closing the Digital Strategy Execution Gap

Author: Guy Pearce and Tony Gaffney

Never before has there been such an intense focus on digital as during the COVID-19 pandemic. This has been especially true for the business continuity management (BCM) efforts needed to provide work-from-home functionality to support social distancing.

Additional languages available: Français

ISACA Journal Article

Case Study: Building an Enterprise Security Program

Author: Katie Teitler

Mercury NZ, a US$2 billion renewable energy generation and retail company, has the most NZ Stock Exchange shareholders of any New Zealand company, serving more than 373,000 residential, commercial, industrial and spot customers across New Zealand.

ISACA Journal Article

Cybersecurity Incident Response: Tabletop Exercises Using the Lego Serious Play Method

Author: Fabian Garzón

It is foolish to wait until an enterprise is in the midst of a data breach to test its cybersecurity incident response plan (CSIRP). How likely is it that the enterprise will know that a cyberattack is underway and be able to react appropriately?

Columns

ISACA Journal Article

Information Security Matters: Privacy by Implementation and Execution

Author: Steven J. Ross

When I was in graduate school, I read a lot of scholarly journals. (None of them were as lively nor as useful as the journal you are now reading.) One of the features I loved best was a rousing argument between academics about matters of miniscule interest to the general public.

ISACA Journal Article

IS Audit Basics: Enhancing the IT Audit Report Using COBIT 2019

Author: Ian Cooke

Earlier this year, I authored a column on the “Components of an IT Audit Report.” These components need to provide assurance, inform auditees and others of management and control issues, recommend corrective action, and represent the quality of the audit and the credibility of the audit organization.

ISACA Journal Article

The Bleeding Edge: Nothing but Blue Skies—Virtualizing Humanity

Author: Dustin Brewer

I have been a remote worker for approximately five years. The transition was not an easy one. However, in the past two years I have come to a very “Zen” place in my work-from-home routine…or lack thereof.

ISACA Journal Article

The Network: Responding to a Changing Business Landscape

Author: Tracey Dedrick

Tracey Dedrick is a C-suite executive experienced in risk, compliance, treasury and investor relations. She was executive vice president (EVP) and head of enterprise risk management for Santander Holdings US, where she was responsible for enterprise risk, operational risk and market risk for the Americas.

ISACA Journal Article

Innovation Governance: Governance for Better Innovation

Author: K. Brian Kelley

Leadership expert and former US Navy SEAL Jocko Willink wrote the following, “And most important, discipline will put you on the path to FREEDOM.” What does this have to do with innovation? Everything, as it turns out.

ISACA Journal Article

Helpsource Q&A

Author: Sunil Bakshi

With the proliferation of cloud computing services available, our organization is considering moving IT-related services to cloudbased services. What are the benefits and risk associated with using cloud services? What steps should we follow when selecting a cloud service provider (CSP)?

Online Exclusives

ISACA Journal Article

Ransomware Response, Safeguards and Countermeasures

Author: Larry G. Wlosinski

It is time to reassess cybersecurity because current efforts to prevent ransomware events are porous and are not fulfilling their purpose. The facts are clear. Ransomware is distributed by a variety of methods, including infected websites, online advertisements and Universal Serial Buses (USBs); direct attacks...

ISACA Journal Article

Blind Spots for Executives Embarking on a Digital Transformation Program: Managing Risk

Authors: Chris Ngiba and Mayank Naik

In response to declining revenue in one of their customer segments due to changes in market dynamics, a group of executives assembled on a Monday morning to come up with a strategic initiative to counter this problem.

ISACA Journal Article

Incident Response Models

Author: Cameron Young

As global regulators start to tentatively embrace the concept of cyberresilience, it is clear that there has been a significant change in the way that cyberattacks are perceived.

ISACA Journal Article

Are Organizations Actually Performing Risk-Based Audits?

Author: Blake Curtis

Organizations place a strong emphasis on cybersecurity, privacy and compliance. However, many enterprises are uneducated when it comes to identifying, assessing, responding to and monitoring these domains. Auditors provide value in these areas and address these deficiencies via various techniques and approaches.

ISACA Journal Article

Using Gamification to Improve the Security Awareness of Users: The Security Awareness Escape Room

Author: Eszter Diána Oroszi

It is vital that organizations take action to improve security awareness. Threat reports increasingly acknowledge and predict attacks connected to the human factor (e.g., ransomware, fake news). Employees pose a high-level risk at all enterprises because it is generally known that they are the weakest link in the chain of information security.

ISACA Journal Article

Impact of GDPR on Threat Intelligence Programs

Author: Larry Marks

The EU General Data Protection Regulation (GDPR) plays a part in enterprises’ overall strategies and, more specifically, in their collection and use of threat intelligence. In particular, it impacts enterprises’ security and privacy strategies for current and planned projects.

ISACA Journal Article

Securing and Embracing Infrastructure as Code

Author: Taimur Ijlal

Recent advances in computing technology have empowered IT professionals to increasingly rely on abstraction, freeing them from the burden of managing infrastructure and allowing them to focus their energies on delivering quality software as fast as possible.

ISACA Journal Article

Essential Functions of a Cybersecurity Program

Author: Steve Akridge

No matter the size of an organization, every organization that depends on information technology to conduct any part of its business should have a functioning cybersecurity program.

ISACA Journal Article

Deploying a Data Security Defense

Author: Jason Jiao

Maintaining data security has become more challenging in recent years. Many countries have passed and adopted comprehensive laws dealing with this issue, and others are debating the necessity of doing so.