Governance

Development of Frameworks & IT Governance

Design the operating model that ties your security and IT program together: governance structure, accountabilities, policy hierarchy, risk and control framework, and reporting, aligned to COBIT, NIST CSF, and ISO/IEC 27001.

Book a scope call All Governance & Frameworks

Overview

A governance framework is the operating model for how decisions get made, who is accountable, and how risk and performance are reported to leadership. It is distinct from security policies, which state rules, and from controls, which enforce them. The framework is the structure that policies and controls hang from.

Without a clear IT governance framework, accountability drifts. Controls are implemented inconsistently. Audit findings repeat because no one owns the program end-to-end. Leadership receives no coherent view of risk. Key stakeholders, from your board to your operational teams, cannot verify that information technology is serving the overall business rather than running in isolation from business strategies.

Effective IT governance aligns your information technology decisions with your business goals, helps organizations manage risks systematically, and gives stakeholders confidence that compliance obligations are met. A structured approach to governance also enables continuous improvement: you can measure performance, identify gaps, and optimize the program as the organization grows. That is the difference between compliance theatre and a security governance program that creates real assurance.

We design governance frameworks, including IT governance frameworks, tailored to your size and sector. The scope covers governance structure and committees, decision rights, roles and accountabilities documented in a RACI model, the policy and document hierarchy, the risk and control framework, and the management reporting model. We align the design to recognised models: COBIT 2019 for IT governance and management, the NIST Cybersecurity Framework for security program structure, and ISO/IEC 27001 for the information security management system. Where your sector or corporate governance obligations require it, we also reference governance standards from ISO 38500 and ITIL for IT service management.

The result is a framework your leadership can own, your auditors can scrutinise, and your team can operate against.

What’s included

Governance structure: committees, forums, and decision-making model
Decision rights matrix defining who approves, owns, and escalates across business units
Roles and accountabilities documented as a full RACI model
Policy and document hierarchy showing how standards, policies, procedures, and guidelines relate
Risk appetite statement, risk assessment methodology, and risk management process for ongoing governance
Management and board reporting model: metrics, cadence, and reporting templates
Strategic alignment mapping showing how IT objectives support overall business strategies and business objectives
Alignment to COBIT 2019, NIST Cybersecurity Framework, and ISO/IEC 27001 governance standards
Reference to ITIL for IT service management and ITSM processes where applicable

How we work

01
Understand
We learn how your organisation currently makes security and IT decisions, where accountability sits today, and what governance obligations your sector and certifications impose. We identify the gaps between where you are and what your frameworks require. We engage key stakeholders across the business to map how IT decisions currently align with business needs and business goals, and where the decision-making process breaks down.
02
Design
We design the governance structure, the decision rights model, the RACI, the policy hierarchy, and the risk and control framework. We size the design to your organisation: a 60-person SaaS company needs a different governance model than a regulated financial institution with 400 staff. The governance framework must align with business strategies without creating overhead that undermines operational efficiency. Good IT governance is not about adding bureaucracy; it is about making accountability explicit so the right decisions get made at the right level.
03
Align
We map the design to the recognised models in scope: COBIT 2019, the NIST CSF, or ISO/IEC 27001. ITIL and ITSM principles apply where IT service management and service delivery processes are in scope. For organisations facing cybersecurity threats across multiple regulatory domains, we use a GRC (Governance, Risk, and Compliance) lens to ensure the framework supports risk and compliance requirements simultaneously. Where an international standard has specific governance requirements, we make sure the design meets them explicitly.
04
Embed
We help stand up the committees, define the reporting cadence, and document the operating model so the framework moves from paper to practice. We define the resource management structure for the governance function and establish a continuous improvement cycle so the framework evolves as your business objectives and regulatory environment change. Governance frameworks that remain documents do not improve security.

What you get

Governance framework document and operating model
Decision rights matrix
RACI and full accountability model
Policy and document hierarchy
Risk appetite statement and risk assessment methodology
Management reporting model and meeting cadence
Framework alignment mapping to COBIT 2019, NIST CSF, and ISO/IEC 27001

Scope clarity

A governance framework engagement covers design, documentation, and the stand-up of committees and reporting. Technical remediation work inside your environment, such as configuring tools or implementing controls, is carried out by your team. We define and verify the controls framework; your engineers implement the controls.

Frequently asked questions

How is a governance framework different from policies and procedures?

Security policies state the rules your organisation follows. Procedures describe how those rules are carried out. A governance framework sits above both: it defines who makes decisions, who is accountable for what, how risk management is structured, and how the overall security and IT program is steered toward business objectives. Policies and controls hang from the framework. Without the framework, security policies remain a collection of documents rather than a coherent compliance program.

Which models do you align to?

We align to recognised governance standards suited to your obligations. COBIT 2019 is the most widely recognised IT governance framework published by ISACA; it defines governance objectives, design factors, and a performance management system that helps organizations align information technology with overall business strategies. The NIST Cybersecurity Framework provides a security program structure recognised by regulators globally. ISO/IEC 27001, an international standard, includes specific governance requirements for an Information Security Management System. ITIL and ITSM principles apply where IT service management and service delivery are in scope. We select and blend them based on your sector, size, and certifications.

Do we need a governance framework if we already have policies?

Security policies without a governance framework leave a critical gap: no one owns the program end-to-end, accountability is unclear, and leadership has no structured view of risk. ISO/IEC 27001 and SOC 2 both require governance evidence beyond the existence of policies. A governance framework is what makes a compliance program coherent rather than a collection of documents. It is also what enables effective risk management: you cannot manage risks systematically without a defined process for identifying, assessing, and escalating them.

How do you size the framework to a smaller organisation?

Governance frameworks do not require a large team or a separate security department to function. For smaller organisations, we design lightweight governance structures, combining roles where appropriate and building reporting models that work within existing leadership cadences. The framework must align with your business needs and be right-sized to be operable. An over-engineered model creates compliance theatre, not real accountability. Effective IT governance at a smaller scale still addresses strategic alignment, resource management, and risk and compliance, but with proportionate overhead.

What is COBIT 2019 and why does it matter?

COBIT 2019 is an internationally recognised IT governance and management framework published by ISACA. It defines governance objectives, design factors, and a performance management system that helps organisations align IT with business goals. Boards, auditors, and regulators in financial services and other regulated sectors recognise it as a credible governance reference. It also provides a process improvement framework for continuous improvement of IT governance maturity over time.

What is the relationship between IT governance and GRC?

GRC (Governance, Risk, and Compliance) is the broader discipline that connects your governance framework, your risk management processes, and your compliance obligations into a single structured approach. An IT governance framework is the core of the G in GRC: it defines the decision-making structure and accountability model. Risk management layers in the processes for identifying and managing risks. Compliance ensures the overall business meets the regulatory and contractual obligations it operates under. We design the governance framework to serve all three functions.

Where does ITIL fit in IT governance?

ITIL (Information Technology Infrastructure Library) is a framework of best practices for IT service management (ITSM). It governs how IT services are designed, delivered, and continuously improved to meet business objectives. ITIL does not replace COBIT; it is complementary. COBIT addresses governance and management of IT overall, while ITIL focuses specifically on service delivery and service management processes. Where your organisation relies on IT services as a core part of operations, we incorporate ITIL best practices into the governance framework design.