Most security standards tell management what to do; very few tell the governing body how to oversee it, and that gap is where board-level accountability for cyber risk breaks down. ISO/IEC 27014 is the ISO/IEC guidance written for governing bodies and top management. It sets six governance objectives and four governance processes, evaluate, direct, monitor and communicate, and explains how they relate to an ISO/IEC 27001 information security management system (ISMS). This guide explains what the standard contains, how to apply it in organisations of different shapes, what evidence shows it is working, and how it maps to ISO/IEC 27001, NIST CSF 2.0 and the UK Cyber Governance Code of Practice. It is for CISOs, company secretaries, risk and audit leads, and directors who want a structured way to govern information security.
Key takeaways
- It is guidance for the governing body, not a certifiable management system. ISO/IEC 27014:2020 gives concepts, objectives and processes; organisations certify against ISO/IEC 27001 and use 27014 to shape the governance layer above it.
- Four processes define the board's job. Evaluate, direct, monitor and communicate, each with separate responsibilities for the governing body and for top management of each ISMS.
- Six objectives describe what good governance achieves. Entity-wide security, risk-based decisions, security in acquisitions, conformance, a security-positive culture and performance that meets current and future needs.
- Organisation shape changes the model. Annex B describes three ISMS organisation types, from a single entity where the board and top management coincide to a shared or outsourced ISMS serving several entities.
- A revision is pending. ISO lists the 2020 edition as "to be revised", so check the catalogue before quoting clause numbers in policies or contracts.
What it is and who it applies to
ISO/IEC 27014:2020, Information security, cybersecurity and privacy protection: Governance of information security, is the second edition, published in December 2020 by ISO/IEC JTC 1/SC 27. It runs to 13 pages and ISO's catalogue shows its status as "International Standard to be revised" (checked 27 October 2026). The same text is published by ITU-T as Recommendation X.1054 (04/21), approved on 30 April 2021, which is freely downloadable from the ITU and is the source used for the clause summaries on this page.
The standard names three audiences:
- Governing bodies and top management: boards, trustees and executive committees accountable for the organisation.
- Those who evaluate, direct and monitor an ISMS based on ISO/IEC 27001.
- Those responsible for information security management outside an ISMS but within the scope of governance, for example in organisations that have not adopted 27001.
It applies to organisations of all types and sizes. There are no "shall" requirements to certify against; it is a guidance document, and its value is in giving boards and security leaders a shared vocabulary. It sits alongside ISO/IEC 38500, which gives principles for the governance of IT (27014 cites the 2015 edition, which ISO has since replaced with ISO/IEC 38500:2024), and its Annex A shows information security governance and IT governance using the same four processes.
Structure and key requirements
The document is short. After scope, terms and a description of how governance and management standards relate (clause 6), the core content is clause 7 on objectives and processes and clause 8 on the governing body's requirements on the ISMS. Annexes cover the governance relationship with IT governance (A), types of ISMS organisation (B) and examples of communication (C).
The six governance objectives (clause 7.2)
| Objective | What it means in practice |
|---|---|
| Establish integrated, entity-wide information security | Security is handled at entity level, covering physical and logical security together, not left to individual departments |
| Make decisions using a risk-based approach | Decisions rest on compliance obligations and the entity's risk appetite |
| Set the direction of acquisition | Information security risk is assessed for investments, purchases, mergers, new technology and outsourcing |
| Ensure conformance with internal and external requirements | Legal, regulatory, contractual and internal commitments are met; top management may commission independent audits for assurance |
| Foster a security-positive culture | Interested parties are coordinated and security responsibilities are built into roles |
| Ensure security performance meets current and future requirements | Performance is monitored at entity level, beyond individual control effectiveness |
The four governance processes (clause 7.3)
| Process | Governing body | Top management of each ISMS |
|---|---|---|
| Evaluate | Ensures initiatives consider risks and opportunities; responds to ISMS measurements by setting and prioritising objectives | Ensures security supports entity objectives; submits significant new projects for approval |
| Direct | Sets strategic direction and objectives, defines risk appetite, approves the information security strategy | Allocates investment and resources, aligns security objectives, assigns roles, establishes the security policy |
| Monitor | Receives reports on ISMS effectiveness, assesses them against entity priorities, communicates priorities to top management | Assesses effectiveness and conformance, watches the changing environment, selects metrics, alerts the governing body to new risks |
| Communicate | Bi-directional: reports externally that security is commensurate with the entity's activities, identifies regulatory obligations and stakeholder expectations, advises top management, promotes culture | Supplies the information the governing body needs for these communications |
Types of ISMS organisation (Annex B)
- Type A: the entity and the ISMS organisation are the same, so the governing body and top management coincide. Typical of a single company with one ISMS.
- Type B: the ISMS organisation is part of a larger entity, which may run several ISMSs. Group boards oversee several subsidiary or divisional ISMSs, and membership overlaps but is not identical.
- Type C: one ISMS serves several entities. Where a third party provides the ISMS as a service, the entities' governing bodies are unlikely to sit in its top management, which makes the communicate process and contractual reporting essential.
Identity and NHI requirements
ISO/IEC 27014 does not mention identity, access management or non-human identities; it works at a level above specific controls. The processes still apply directly, and identity risk is a good test of whether governance is real, because it crosses every department and every supplier.
- Evaluate: the governing body should see identity risk in decisions on acquisitions, cloud adoption and AI agent deployment, since each one creates new service accounts, API keys and tokens. This is the "set the direction of acquisition" objective applied to machine identities.
- Direct: risk appetite statements should cover privileged and machine access explicitly, for example tolerance for credentials without owners or without rotation. See the Cyber Risk Appetite Statement Template.
- Monitor: reports to the board can include a small set of identity measures, such as the percentage of NHIs with a named owner and privileged accounts under PAM. See the Board Briefing: NHI Risk and the Identity Security Metrics Guide.
- Communicate: external statements on security should not claim control over identities the organisation has not inventoried. Use a maturity view such as the NHI Governance Maturity Model to describe progress honestly.
Implementation steps
- Identify your ISMS organisation type. Use Annex B to decide whether you are type A, B or C. This determines who the governing body is for each ISMS and where reporting lines run.
- Map current governance against the four processes. For each process, list who does it today, in which forum, how often and with what inputs. Gaps usually appear in evaluate (projects approved without security input) and communicate (no external statement owner).
- Set terms of reference. Write the board or risk committee's responsibilities for evaluate, direct, monitor and communicate into its terms of reference, and the CISO's reporting obligations into theirs. See the Security Governance Committee Charter Template.
- Agree risk appetite and strategy. The direct process needs an approved information security strategy and risk appetite. See the Security Strategy and Roadmap Guide and the Risk Appetite and Tolerance for Cyber Guide.
- Design board reporting. Choose a short set of entity-level measures that show performance against the six objectives, not a list of control statistics. See the Board Cyber Risk Reporting Guide.
- Embed security in acquisition decisions. Add a security risk section to investment, procurement, outsourcing and M&A approval papers.
- Pilot for one cycle, then review. Run one full annual cycle, ask the board to self-assess against the objectives, and adjust. If the board finds the reporting unusable, simplify the measures rather than adding more.
Scaling the model
- Small organisations (usually type A): the board and top management are often the same few people. Combine the processes into one quarterly agenda item with a standing structure: decisions needing security evaluation, direction given, performance against appetite and anything to communicate externally. A one-page strategy and a one-paragraph risk appetite are enough to start.
- Mid-sized organisations: delegate monitoring to an audit or risk committee with a clear escalation route to the full board, and keep strategy approval and risk appetite with the board itself.
- Groups and regulated entities (type B): define which decisions sit with the group board and which with subsidiary boards, and require each ISMS to report on a common set of measures so the group board can compare them.
- Shared or outsourced ISMS (type C): write the communicate process into the service contract: report content, frequency, escalation of significant risks and the right for each customer's governing body to receive them.
Rollback and adjustment: governance changes rarely fail outright; they fail by being ignored. If after two board cycles reports are not discussed or decisions are not recorded, reduce the reporting to fewer measures and tie each one to a decision the board is asked to make.
Evidence and assessment
Because 27014 is guidance, there is no certification. Assurance comes from internal audit, from ISO/IEC 27001 certification audits of leadership and management review, and from board effectiveness reviews.
| Process | Evidence an auditor or regulator would expect |
|---|---|
| Evaluate | Board and committee papers for major projects, acquisitions and outsourcing that include a security risk assessment, and minutes showing it was discussed |
| Direct | Approved information security strategy, risk appetite statement, security policy signed off by top management, budget decisions |
| Monitor | Regular board security reports, ISMS management review outputs, internal audit reports, records of actions set by the board and their closure |
| Communicate | Annual report or regulatory statements on security, stakeholder communications, training and culture records for directors |
Useful measures of governance itself include: the share of major investment decisions with a documented security assessment; time from a significant risk being reported to a board decision; the share of board actions closed on time; and director attendance at security training. See the Internal Audit for Cybersecurity Guide and the Three Lines Model for Cyber Risk Guide.
Mapping to other frameworks
| ISO/IEC 27014 element | ISO/IEC 27001:2022 | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 |
|---|---|---|---|
| Evaluate | Clause 6.1 actions to address risks and opportunities | GV.OC-02, GV.SC-06 | PM-9 Risk Management Strategy |
| Direct | Clause 5.1 leadership and commitment, 5.2 policy, 5.3 roles | GV.RM-02, GV.RR-01, GV.RR-03, GV.PO-01 | PM-1, PM-2, PM-29 |
| Monitor | Clause 9.1 monitoring and measurement, 9.2 internal audit, 9.3 management review | GV.OV-01, GV.OV-02, GV.OV-03 | PM-6 Measures of Performance, PM-31 Continuous Monitoring Strategy |
| Communicate | Clause 7.4 communication | GV.OC-02, GV.OC-03 | PM-1 |
| Security-positive culture | Clause 7.3 awareness | GV.RR-01, PR.AT-01 | PM-14 Testing, Training and Monitoring |
Other related frameworks: ISO/IEC 38500 for IT governance principles; COBIT 2019, whose governance objectives follow the same evaluate, direct and monitor pattern (see the COBIT 2019 Guide); and the UK Cyber Governance Code of Practice, published on 8 April 2025 for boards and directors (see the UK Cyber Governance Code of Practice Guide). CSF 2.0's Govern function covers much of the same ground in outcome form, so organisations using CSF can use 27014 to define who performs each Govern outcome. See the NIST CSF 2.0 Guide.
Common pitfalls
- Treating it as a certification target: 27014 has no certification scheme; claims of "27014 compliance" should be backed by governance evidence, not a certificate.
- Monitor without direct: boards receive security dashboards but never approve a strategy or risk appetite, so there is nothing to measure against.
- Control statistics instead of entity performance: reports list patch rates and phishing clicks rather than progress against objectives and appetite.
- Missing the evaluate step on acquisitions: mergers, outsourcing and new platforms are approved before security has assessed them, contrary to the acquisition objective.
- Ignoring organisation type: group structures run several ISMSs but the group board receives reporting from only one, or outsourced ISMS services report to nobody on the customer's board.
- Quoting stale clauses: policies cite the 2013 edition or will cite the 2020 edition after the pending revision; check the catalogue before referencing clause numbers.
Practitioner checklist
- Confirm the current edition and status on the ISO catalogue before referencing it.
- Classify each ISMS as Annex B type A, B or C and record its governing body.
- Write evaluate, direct, monitor and communicate responsibilities into board and committee terms of reference.
- Obtain board approval of the information security strategy and risk appetite.
- Add a security risk section to investment, outsourcing and M&A approval papers.
- Report to the board on entity-level performance against the six objectives, including identity and NHI risk.
- Name an owner for external security communications and regulatory statements.
- Track board security actions to closure and review governance effectiveness annually.
Standards and references
- ISO: ISO/IEC 27014:2020 Information security, cybersecurity and privacy protection, Governance of information security
- ITU-T: Recommendation X.1054, Governance of information security
- ISO: ISO/IEC 27001:2022 Information security management systems, Requirements
- ISO: ISO/IEC 38500:2024 Governance of IT for the organization
- NIST: Cybersecurity Framework 2.0
- NIST: SP 800-53 Rev. 5
- GOV.UK: Cyber Governance Code of Practice
Related NHI Mgmt Group resources: ISO 27001 Certification Guide · Board Cyber Risk Reporting Guide · UK Cyber Governance Code of Practice Guide · CISO Guide: First 90 Days. This guide summarises ISO/IEC 27014:2020 and is not legal advice.