Governance, controls, frameworks and policies

Connect decisions, risk and obligations

Governance establishes direction, accountability and oversight. Risk management helps make decisions under uncertainty about objectives. Compliance concerns applicable obligations and evidence that they are met. They overlap: a compliant control can still leave material risk, while a useful security practice is not automatically a legal requirement. Management needs a view of priorities, resources and results.

Use frameworks for their actual purpose

NIST CSF 2.0 organizes cybersecurity outcomes under Govern, Identify, Protect, Detect, Respond and Recover. These functions interact continuously; they are not six one-time stages. A current profile describes selected present outcomes, a target profile desired outcomes, and the comparison helps prioritize gaps. CIS controls give a different, more specific safeguard orientation. Neither source grants ISO certification. A GRC tool can track owners, decisions and evidence, but a dashboard or register cannot make the decisions itself.

Tell controls apart without forcing a single box

Technical controls operate through technology; administrative controls include direction, processes and responsibilities; physical controls protect locations and equipment. A visitor process can combine an administrative rule, a physical barrier and an electronic badge system. Layering can reduce exposure when one control fails; it does not prove that every layer is independent or effective.

Understand documents by their role

A policy gives direction and expectations. A standard can set specific requirements; a procedure explains how to carry out an activity. NIST’s background taxonomy includes program, issue-specific and system-specific policies. PECB’s current handbook instead names high-level general, high-level specific and topic-specific policies. Those syllabus labels are verified; their definitions, distinctions and applied examples are not defined by that public handbook. Do not assume a one-to-one mapping between the two taxonomies.

Include AI within existing governance

Editorial application: an AI service needs an owner, a defined use, applicable obligations and a risk decision just as other services do. Compare a provider’s capability claim with evidence about its actual use. The current ISC2 AI guidance applies governance and layered controls within CC; it does not create an exemption from ordinary policies or require a separate AI-specialist credential.

Connect the terminology.