Skip to main content

Who Should Be On Your Information Risk Council

Information Risk Council

The Information Risk Council (IRC), also known as the Risk Governance Council or Security Steering Committee, is a key component of an effective security program, especially if it is aligned with ISO 27001 or SOC 2. This committee helps establish the vision for the organization’s security program, drives the strategy, and sets the tone for security, privacy, and compliance initiatives. There’s a lot at stake, so making sure the IRC is comprised of the right people is paramount.

So, who should be on my IRC?

We get this question a lot, so here are some individuals and teams we suggest you include, and considerations for why you may or may not want to include them. These are in no particular order, and titles will vary somewhat depending on the size of your organization. The essential goal here is to establish an impactful and cross-functional team with the authority and insight to align your security program to your business strategy.

Members to Consider:

  • Chief Technology Officer: Often also the security program sponsor, the CTO serves as a bridge between the security program and the business objectives established by executive leadership. (Note: If you are not a SaaS/tech firm, you may want to include the VP of Services or Chief Operating Officer instead.)
  • VP of Engineering: The person responsible for managing your SaaS platform fills a critical role by ensuring that change management processes and infrastructure efforts are aligned with the security objectives.
  • CISO/VP of Security: Independent of their title/role, the person responsible for the effective operation of security initiatives should always be included in your IRC.
  • General Counsel: Legal professionals often have the best understanding of the risks the organization faces and security commitments that the organization has made.
  • Director of Compliance: This position is critical if you have a team dedicated to financial compliance initiatives such as SOC 1 or SOX, as there will be overlapping areas of risk management.
  • HR/Chief People Officer: People are key to any organizational initiative, so having your HR team on board will help provide valuable feedback on your company's security implementation.
  • Director of IT: This person is usually responsible for the operations of various security controls and making sure security objectives are technically feasible.
  • Sales: Your sales team is often closest to the customer, the market's expectations for security, and the specific expectations clients have in this realm.
A good IRC size is between five and seven members and pulls in additional resources and business unit leaders for consultation. Please get in touch with us to learn more.
Phillip Lee Phillip Lee

Like our content? Subscribe and stay informed.

Related posts

Tags

See all