Key Takeaways Security governance is the layer that sets direction for security and holds the organization accountable for following it. It decides which risks to accept, who answers for the result, and what evidence proves the direction still holds. Management plans, builds, and runs the controls that carry that direction out.