The sentence before the first control

The most basic control in information security is not a control.

It is a sentence: what this program protects, for whom, and by whose authority. Ask whoever runs your security for it.

Last time, the patch had no owner. The cause sits upstream: nobody can assign what was never defined. Defining it takes four steps.

Alignment says what matters. Security does not exist to be secure; it exists so the business can sell, deliver and keep customers. Name the few outcomes that would end the company, ranked the way the business ranks them. A program that cannot is aligned to last year’s renewal list.

The charter says who decides: what security decides, what it only advises on, and where that line falls. It can be one page the chief executive signs. Without one, the team’s authority is whatever the loudest executive conceded most recently.

The rules already ask for the skeleton. Public companies must disclose whether and which management positions are responsible for cybersecurity risk.¹ HIPAA requires health care organizations, and the vendors that handle their patient data, to identify a security official.² The FTC Safeguards Rule, 16 C.F.R. § 314.4, requires financial institutions under the FTC’s jurisdiction, including car dealers that arrange financing, to designate a qualified individual to oversee, implement and enforce the program.³ That person may work for an outside IT provider; the business still keeps responsibility for compliance. The Safeguards Rule also reaches vendors through their customers’ contracts.³ A vendor should have its own answer first. None of these rules says what that person may decide alone. That part is the charter.

The mission makes it portable, in plain words specific enough to be yours. “Protect our people, our data and our reputation” fits a bank, a hospital and a moderately careful dog walker.

Strategy comes last because it needs the other three: not a list of initiatives, but their order. Without sequence, it is a wish list with a budget attached.

NIST made the same move. Its Cybersecurity Framework filed governance under Identify in 2014,⁴ then in 2024 made Govern a sixth function and put it at the center of the wheel.⁵

Skip the four and the work still happens, which is why the gap is hard to see. It just cannot say why, which is how a patch goes unassigned and a password rule outlives its evidence.

So ask for the sentence. A dealership’s might read: protect credit applications, keep the dealer management system up at month-end, stop wire fraud on payoffs. Its software vendor’s: keep each customer’s data walled off from the next, keep the platform up at their busiest hour, keep our access to their systems from becoming someone else’s way in. A clinic’s: keep patient records private, keep scheduling up during clinic hours, get claims paid. Each signed by someone who can say no. What does yours protect, for whom, and who decided? If the answer takes more than a minute, the program has not been aimed. It has only been staffed.