What is Governance?
Governance is the system of frameworks, roles, responsibilities and decision-making processes through which an organisation’s board sets direction for, oversees and accounts for its information provision, technology and processes. Governance determines who decides what, on what basis and with what mandate. It is not about doing the day-to-day work, but about the rules within which that work happens. Where IT and OT come together, governance is where you record who owns a plant system, who may accept risk and who reports to the board.
Governance determines who decides what, on what basis, and with what mandate, and thereby forms the backbone of control and coherence in digital and industrial environments.
🧠 Why is governance important?
Without governance you get isolated decisions per department, unclear ownership and risks that nobody has consciously accepted. Good governance delivers five things:
| Reason | Explanation |
|---|---|
| Accountability | Clear ownership of systems, data and processes |
| Risk management | Technical, legal and ethical risks are deliberately weighed and either accepted or treated |
| Coherent decision-making | Prevents fragmented choices, duplicate investments and unnecessary costs |
| Oversight and accountability | Basis for Compliance, audits and transparency towards regulators |
| Direction and prioritisation | Sets the strategic course for digitalisation, innovation and standardisation |
Since NIS2, governance is no longer optional either. Article 20 of the directive requires the management body to approve the cybersecurity measures and oversee their implementation, and board members can be held liable if they fail to do so.
🔄 What is the difference between governance and management?
Most frameworks draw a sharp line between governance (directing and overseeing) and management (planning and executing). ISACA’s COBIT 2019 sets this out in five domains with 40 objectives in total: only the Evaluate, Direct and Monitor domain (EDM, five objectives) is governance, while the other four are management.
| Aspect | Governance | Management |
|---|---|---|
| Who | Board of directors, executive board, supervisory body | Line management, IT manager, OT manager, CISO |
| Core question | Are we doing the right things? | Are we doing things right? |
| Activities | Evaluate, direct, monitor | Plan, build, run, measure |
| COBIT domain | EDM | APO, BAI, DSS, MEA |
| Example in OT | Deciding that every plant system has an owner and a risk assessment | Building and maintaining an asset inventory |
The ISO/IEC 38500 standard uses the same three-step model: the governing body evaluates current and future use of IT, directs through policies and plans, and monitors whether execution conforms. The 2024 edition replaces the 2015 edition and aligns with ISO 37000:2021, the general guidance on the governance of organisations. As a result the number of principles grew from six to eleven, and governance of IT is explicitly part of the governance of the organisation as a whole.
🧱 At which levels does governance operate?
Governance can be applied at different levels:
| Level | Examples |
|---|---|
| Strategic | Vision, policy, risk appetite, architectural frameworks (NORA, BIO, enterprise governance) |
| Tactical | Programmes, portfolio management, information policy, sourcing and supplier policy |
| Operational | Project steering, Lifecycle Management, patch management, access management, change management |
This layering aligns with ISACA’s COBIT and with ISO/IEC 38500, a joint standard of ISO and IEC. An architecture framework such as TOGAF adds its own form of architecture governance.
Many organisations organise oversight according to the Three Lines Model published by the Institute of Internal Auditors in 2020, the successor to the earlier three lines of defense. The first line (operations, for example the plant) owns the risks. The second line (risk management, compliance, the security office) supports and challenges. The third line (internal audit) gives independent assurance to the board, which remains ultimately accountable.
🔄 How are governance and architecture related?
Governance and architecture are closely linked:
- Architectural principles provide directional frameworks for decision-making
- Governance ensures compliance, ownership and decisions on deviations
- Within NORA, GEMMA, WILMA and MARIJ, architecture governance is a standard component
| Architectural framework | Governance component |
|---|---|
| NORA | Principles and models are anchored through governance |
| PETRA | Provinces formalise ownership and decision-making authority |
| WILMA | Describes roles for changing or adopting building blocks |
🏭 Why is governance harder in OT than in IT?
In operational technology (OT) two worlds collide. IT traditionally reports to the CIO, while plant systems belong to production, engineering or maintenance. Suppliers and system integrators often manage parts of them remotely. Installations run for twenty years or more, and availability and safety come before confidentiality. As a result, typical governance questions remain unanswered:
| Governance question | Relevance in OT |
|---|---|
| Who owns a PLC? | Determining ownership, management and documentation |
| Who decides on firmware updates? | Trade-off between safety, stability and maintenance windows |
| Who manages network segmentation? | Role allocation between IT, OT and security |
| Who accepts residual risk for legacy systems? | Risk acceptance when a system cannot be patched |
| Who carries out audits? | Oversight against IEC 62443, BIO or your own security policy |
Without governance, OT often stays out of view in organisational policy, with risks of ambiguity, underinvestment and vulnerability. IEC 62443-2-1 addresses this: its second edition of August 2024 describes the asset owner’s security programme in so-called security program elements, with a maturity model. For legacy systems that cannot meet every requirement, the standard asks for policies and procedures with compensating measures. NIST SP 800-82 Rev. 3 recommends that the OT security programme is carried by a cross-functional team from IT, OT, process safety and management.
🔐 What role does governance play in security and legislation?
| Security topic | Governance role |
|---|---|
| Security by Design | Governance makes it a requirement in projects and procurement |
| Privacy by Design | Governance ensures privacy is considered from design onwards |
| Cybersecurity | Governance defines policy, oversight and accountability for incidents |
| Patch Management | Who is allowed to update what, and under what conditions? |
| Supplier Security | Who sets requirements for suppliers and checks them? |
Legislation and standards increasingly lay down governance requirements for security:
- NIS2 and the Dutch Cybersecurity Act - since 15 August 2026, the board approves the measures, oversees implementation and every board member follows cyber-risk training. At essential entities a director can be temporarily suspended for serious infringements.
- ISO 27001 - clause 5 (Leadership) requires demonstrable top-management commitment and defined roles and authorities within the ISMS.
- NIST CSF 2.0 - the February 2024 version added the Govern function, with six categories: organisational context, risk management strategy, roles and authorities, policy, oversight and supply chain risk.
🔧 How do you set up IT/OT governance?
A practical approach for an industrial organisation in seven steps:
- Define the scope - which sites, plant systems and networks fall under the programme, and are you in scope of the Cybersecurity Act?
- Assign owners - every plant system gets an owner in the line organisation, not in IT; record this in a RACI matrix
- Set up a steering committee - with production, engineering, IT, security and process safety, chaired by an executive
- Define risk appetite - what does the board accept, and who may sign off residual risk? Link this to risk management based on, for example, ISO 31000
- Write policy - one security policy with an OT section or a separate OT policy, derived from IEC 62443
- Set up oversight - quarterly reporting to the board with a handful of indicators, such as the share of plant systems with an owner, open critical vulnerabilities and segmentation status
- Review and improve - an annual internal audit and management review, and a new gap analysis whenever legislation changes
A common mistake is to equate governance with a policy document. The document only adds value when decisions are demonstrably made according to the agreed roles.
❓ Frequently asked questions
What is the difference between governance and compliance?
Governance is the system through which an organisation itself sets direction, decides and oversees. Compliance is demonstrably meeting laws, standards and internal policy. Good governance makes compliance possible, but governance also covers choices that no law prescribes.
Who is responsible for OT governance?
The board of the organisation is ultimately accountable for OT governance, certainly under NIS2 and the Dutch Cybersecurity Act. Execution usually lies with a CISO or OT security manager together with the owners of plant systems in production and engineering. IT, OT and process safety each have a seat on the steering committee.
Which standards cover IT governance?
The main standards for IT governance are ISO/IEC 38500 (2024 edition), which gives principles for the governing body, and ISACA’s COBIT 2019, with 40 governance and management objectives. ISO 37000 describes the governance of organisations in general. For OT security, IEC 62443-2-1 adds requirements for the asset owner’s security programme.
Is governance mandatory under NIS2?
Yes, NIS2 makes cybersecurity governance mandatory for essential and important entities. Article 20 requires the management body to approve the measures, oversee their implementation and follow training. In the Netherlands this has applied through the Cybersecurity Act since 15 August 2026.
What is the Three Lines Model?
The Three Lines Model of the Institute of Internal Auditors (2020) divides risk-management roles over three lines: operations as risk owner, support functions such as risk management and compliance, and independent internal audit. The governing body remains ultimately accountable for governance. The model replaced the older three lines of defense.
How do you measure whether governance works?
You measure whether governance works with a small set of indicators the board sees periodically, such as the share of plant systems with a named owner, the lead time of risk acceptances and audit findings. The maturity levels in IEC 62443-2-1 show how the organisation is developing, and the NIST CSF Tiers indicate how rigorous its cybersecurity risk governance and management are.
📌 In summary
Governance is the board-level structure behind technology: it defines who decides, who owns and who oversees. It provides control, direction and accountability in both IT and OT, and since NIS2 and the Dutch Cybersecurity Act it is also a statutory board responsibility.
Frameworks such as ISO/IEC 38500, COBIT and the NIST CSF provide the structure, IEC 62443 translates it to industrial plant systems, and architecture frameworks such as NORA ensure coherence. If you settle ownership, risk acceptance and reporting clearly, you lay the foundation for reliable, secure and future-proof information provision.