Task force: Infosec must be part of corporate governance

"This is not a technology, CIO, or chief security officer issue," Bill Conner, co-chair of the task force and president and CEO of Entrust, said in a media conference call. "The issue is a corporate governance, board level and CEO issue."

The group said infosec governance needs to be voluntary instead of mandated by government. To that end, it urged companies of all sizes to adopt the infosec governance framework it developed and indicate on their web sites their commitment to infosec governance. The task force also developed a "core set of principals" to help organizations develop infosec governance programs.

In addition, the group recommended that the Committee of Sponsoring Organizations of the Treadway Commission (COSO) revise the Internal Controls-Integrated Framework so it clearly addresses infosec.

"We want to make it clear that the leaders of organizations today already have a fiduciary responsiblity to have strong information security," said Art Coviello, task force co-chair and president and CEO of RSA Security.

The recommendations from the NCSP's Corporate Governance Task Force are the latest from the NCSP, which is a coalition of business and technology groups. Other NCSP task forces previously released recommendations on improving software security, security awareness, and developing early warning systems.

www.cyberpartnership.org