Skip to content
HRM Framework 2.0 , home
Start the assessment

Practice 05 of 6Scored 1 to 52 questions in the assessment

Govern

Who owns human risk, and what decision rights, budget and policy do they hold?

Govern is the practice of ownership and decision rights: who is accountable for human risk, which partners sit in the review, what policy covers people and AI agents, how exceptions expire, and what the board has set as risk appetite.

Start the assessment See the matrix

Why it matters

Govern, in practice.

Playbooks that change controls need a mandate. Without named ownership, decision rights and policy, a program can measure risk and still change nothing. Governance also covers what the program may do to people, which keeps HR, legal and the works council as partners.

Risk domains it touches

The five levels

The five levels of Govern.

Each level with its criteria, the evidence to ask for and what moves the practice to the next one.

  1. Level 1

    Comply

    The awareness lead alone, with a training mandate.

    • Human risk is owned by the security awareness lead alone.
    • The program’s written mandate, where one exists, is training completion.
    • Budget covers content and simulation licenses only.
    • No policy names human risk or AI use.

    Evidence to ask for

    The program’s charter or mandate, where one exists · The budget line

    What moves you to level 2

    • Write a one-page charter naming owner, scope, partners and reporting cadence.
    • Add the GRC lead to the program review.
    • Publish an AI acceptable-use policy.

  2. Level 2

    Observe

    A charter, GRC as co-owner, an AI policy, exceptions with expiry dates.

    • A written charter names the owner, scope and reporting cadence.
    • The GRC lead co-owns the program and maps it to the control framework.
    • An AI acceptable-use policy is published and acknowledged by the workforce.
    • Policy exceptions are recorded with an owner and an expiry date.

    Evidence to ask for

    The charter · The AI acceptable-use policy with its acknowledgment rate · The exception register

    What moves you to level 3

    • Move ownership to CISO staff with the SOC as a standing partner.
    • Start a monthly review with IT and HR and record decisions.
    • Set a target per priority cohort and have the CISO approve it.

  3. Level 3

    Prioritize

    CISO staff own it; monthly review with SOC, IT and HR; targets; agents have owners.

    • Human risk is owned by CISO staff with the SOC as a standing partner.
    • A monthly review includes IT, HR and the SOC, and its decisions are recorded.
    • Each priority cohort has a target approved by the CISO.
    • Policy requires a named human owner for every AI agent and service identity.

    Evidence to ask for

    Minutes of the last three reviews · The target list · The agent ownership policy

    What moves you to level 4

    • Give the review written decision rights over the controls playbooks change.
    • Add Finance and Legal to the forum.
    • Draft the human risk appetite statement.

  4. Level 4

    Orchestrate

    An executive forum with decision rights; a risk appetite statement; privacy review on file.

    • A named executive forum (CISO with IT, HR and Finance) holds decision rights over the controls that playbooks change.
    • A human risk appetite statement exists and is reviewed each year.
    • Each automated action has a privacy review on file, including works-council or employee notice where required.
    • The AI agent lifecycle (approval, scope, attestation, retirement) is policy with a named owner.

    Evidence to ask for

    The forum’s terms of reference · The risk appetite statement · The privacy review file

    What moves you to level 5

    • Name a board member or committee as owner of the human risk KRIs.
    • Put security outcomes in executive performance reviews.
    • Commission an annual independent review of the model and its automation.

  5. Level 5

    Preempt

    A board owner for the KRIs; executive accountability; annual independent review.

    • A board member or committee owns the human risk KRIs and reviews them each quarter.
    • Executives carry security outcomes in their performance reviews.
    • The model, the automation and the privacy controls are reviewed independently each year.
    • Crossing a risk appetite threshold triggers a defined escalation with a named owner.

    Evidence to ask for

    The board agenda item and minutes · The independent review report · The escalation procedure

    How to hold level 5

    • Rehearse the escalation path once a year.
    • Re-confirm ownership and decision rights after each reorganization.

Playbooks

Playbooks for Govern (10).

The assessment picks from these for your 90-day roadmap, by your current level. Each playbook is Easy, Medium or Hard; a quick win is an Easy playbook.

Scroll sideways to see every column.

From levelPlaybookOwnerWeeksDifficultyMeasure
1

Write a one-page program charter

Name the owner, scope, partners, reporting cadence and the decisions the program can make. A charter is the first governance artifact anyone will ask for.

 Security awareness lead 1–2 Easy Charter signed by the CISO
1

Publish an AI acceptable-use policy

State which tools are sanctioned, what data may never enter a prompt, and how to request a new tool. A policy makes shadow AI measurable.

 GRC lead 5–8 Medium Share of the workforce that acknowledged the policy
2

Give every policy exception an expiry date

Record exceptions in the ticket system with an end date and an owner. An expired exception is risk with no owner.

 GRC lead 1–3 Easy Exceptions past expiry
2

Start a monthly review with the SOC, IT and HR

Review cohorts, decisions and blocked actions with minutes. Decisions need the partners in the room who can carry them out.

 CISO 5–9 Medium Reviews held with recorded decisions
3

Require a named human owner for every AI agent

Add owner, scope and retirement date as required fields for any agent or service identity. Ownership is the base of agent governance.

 Identity team 1–4 Easy Agents with no owner
3

Give the review decision rights over controls

Agree in writing which MFA, access and DLP changes the program may trigger and which need IT or HR sign-off. Decision rights turn playbooks into action.

 CISO 5–10 Medium Control changes approved in the forum
4

File a privacy review for each automated action

Record the lawful basis, the data used and the works-council or employee notice for each automated action. The file keeps automation running when HR or legal asks.

 HR business partner 1–4 Easy Automated actions with a privacy review on file
4

Write the human risk appetite statement

State the tolerated level per KRI and the escalation when it is crossed. Risk appetite is what the board can govern.

 CISO 5–9 Medium KRIs with an approved threshold
5

Name the board owner of the human risk KRIs

Agree which board member or committee reviews the KRIs each quarter and record it in the committee’s terms of reference. A named owner makes the KRIs real.

 CISO 1–3 Easy Board reviews held per year
5

Commission an annual independent review

Have internal audit or a third party review the model, the automation and the privacy controls each year. Review is the price of automation at scale.

 GRC lead 5–13 Hard Findings closed inside the agreed window
Cite this term

"Govern: the practice", Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/maturity-model/govern

HRM Maturity Assessment

Where does your program stand?

An initial assessment: 18 questions, about 4 minutes. Your level, six practice scores and a 90-day roadmap, shown immediately.

Questions
18
Minutes, about
4
Start the assessment

Suggest a change

What kind of change?

Only if you would like a reply. See the privacy notice.

 Feedback
Start the assessment