Read my writings on security, risk, governance, organizational relationships, and leadership. These articles bring together practical methods, questions, and perspectives informed by 40 years of experience.
The collection begins with Discipline Diamond Methodology, Entity Management, and Information Security Governance — The PSGI Methodology. Additional topics will develop over time.
-
A Structured Approach to Information Security Governance
The G360 Policies, Standards & Governance Instruments (PSGI) Methodology provides a structured approach to enterprise information security governance. It connects Policies, Standards, Governance Instruments, and operational Procedures through a unified governance hierarchy, supported by traceability, Entity applicability, controlled exceptions, and an overarching Information Security Management System (ISMS).
-
PSGI Implementation Guide — Putting Information Security Governance into Practice
The G360 PSGI Implementation Guide provides practical guidance for establishing and maintaining a coordinated enterprise information security governance program. It explains how to organize governance documents, establish accountability, manage applicability across business Entities, maintain requirements traceability, oversee exceptions, and implement the five-stage PSGI governance and maintenance process.
-
Hierarchical Requirements Traceability — Connecting Information Security Governance Requirements
Hierarchical Requirements Traceability establishes clear relationships among enterprise information security Policies, Standards, Governance Instruments, and operational Procedures. Through permanent document identifiers, governing references, and controlled document registers, organizations can identify the origin of requirements, evaluate the impact of changes, demonstrate accountability, and maintain consistency across business Entities.
-
Building Effective Parent–Subsidiary Relationships
Effective information security governance across multinational enterprises requires clearly defined relationships between parent organizations and their subsidiaries. This article examines how enterprise-wide governance, local management responsibilities, accountability, reporting, and coordinated oversight can support consistent security and risk management while accommodating the operational, regulatory, and organizational requirements of individual business Entities.
-
Understanding the Discipline Diamond Methodology
The Discipline Diamond Methodology provides a visual way to examine an organization’s information security strengths and weaknesses. This introduction explains how its interconnected disciplines help security and risk managers clarify responsibilities, identify gaps, and set priorities for improvement.
Join the Discussion
Your questions and perspectives are welcome. Use the comments on individual articles to share relevant experiences, explore an idea, or offer a different viewpoint.
All comments are reviewed before appearing. Please keep contributions respectful and relevant, and avoid sharing confidential, client, or sensitive personal information.