From Concept to Practice: Untangling the Direct-Control Cycle

Good information security governance will ensure that information is adequately protected. An organization needs a holistic policy framework that assists in providing guidance to ensure that implementations are in line with strategic goals. However, there is little guidance in practically implementing the information security framework that includes the direct-control cycle. This paper sets out to breakdown the direct-control cycle to reveal practical components in implementing strategic, tactical and operational policies in organizations through a literature survey. The output of this paper is a conceptual breakdown of the direct-control cycle that could be used in organizations.