IT GRC Forum

We hear a lot of talk about needing good information security processes, but why are they so important? Well, besides being the basis for a strong security program and compliance with regulatory guidance, they also represent the best way to get consistency across the security initiative and between silos of knowledge. Done right, good security processes halt infosec by "cult of personality", but they aren't infallible. Here are three things that having good information security processes won't do:

Business - IT alignment, when you read the articles written on the subject it turns out most of the time they focus on alignment between business and IT on a strategic level. But alignment between the two on tactical and operational level is just as important. So how about the Information Supply and demand relationship?

In part one I discussed the first reason why I do not like the term ’business-IT alignment’. The term suggests that business is one homogenous entity with clear and consistent requirements for the IT domain, which in my experience it is not. The second reason I dislike the term is that it suggests an “us against them” mentality between business and IT that is common and (even worse) found acceptable in many organizations.

The summer is always a nice time to step back and look at what you are doing. While I enjoyed the nice weather in the south of France and watched my kids play on the beach I thought about why I dislike the term ’business-IT alignment’. I know, I am a workaholic: you should not spend your summer holiday thinking about these kinds of things. I just like my work so there you go…

Each builder knows tools are not the goal they are just the means to an end. After talking to his customer the builder knows what the goal is. He looks over the situation, decides what the solution should be and if he needs screws he reaches into his toolkit and picks up a screwdriver, and if a nail does the trick… you guessed it, a hammer.