2. Information Security Governance (17%)

Governance is where the manager mindset from Phase 1 becomes structural: who has authority, who is accountable, and how the organization commits, on paper and in its org chart, to treating information security as a business risk rather than an IT afterthought.