Governance: Policies, Roles, and Accountability
Governance is the layer that decides, on paper, how an organization is supposed to run, and who is on the hook when it doesn't. Without it, risk and compliance work have no foundation to stand on: nobody has the authority to approve a control, and no policy exists for an audit to check against.
Policies, standards, and procedures
These three terms get used loosely, but they mean different things and sit at different altitudes:
| Level | Answers | Example |
|---|---|---|
| Policy | What must always be true, and why | "All customer data must be encrypted at rest." |
| Standard | The specific, measurable requirement | "Encryption must use AES-256 or stronger." |
| Procedure | The step-by-step how | "Run terraform apply with the encrypted-storage module to provision a new encrypted bucket." |
A policy rarely changes, it states an intent. Standards and procedures change more often, as tools and best practices evolve, while still satisfying the same policy above them.
The three lines of defense
A common model for assigning accountability across an organization:
- First line: the people doing the work day to day (engineers writing code, ops running infrastructure), responsible for managing risk as part of their normal job.
- Second line: risk, security, and compliance teams who set standards, monitor the first line, and provide oversight, without doing the first line's work for them.
- Third line: internal audit, independent of both the first and second lines, verifying that the whole system actually works as described.
TIP
If you're an engineer, you are almost always the first line of defense, the controls and policies described in this course exist to guide decisions you're already making, like who gets access to a database or how a secret gets stored.
RACI: who's Responsible, Accountable, Consulted, Informed
A RACI matrix assigns one of four roles to each person or team for a given decision or process, and critically, only one person or team can be Accountable for a given item, even if several are Responsible for doing the work. Ambiguity about who is actually accountable is one of the most common root causes behind a control silently failing.