Looking over his glasses with a librarian's stare, an executive recently told me, "You IT people love the word 'governance' but it just seems too..." His voice trailed off as he searched for a way to tactfully convey his sense that "information governance" was a linguistic wedge designed to throw open the doors of board-level access for unkempt geeks and helpdesk managers. Instead of "governance," more comfortable phrases were suggested: "information policy board," "data management" or perhaps "IT steering committee."

Governance is a powerful word, and its use in an IT context implies that information is important -- which of course it is. Stripping away the trappings of applications, systems and networks, information is the core asset of most organizations. Establishing information governance is not, as some might think, the elevation of firewall administration to a board-level duty, and it doesn't mean the security controls that protect information subvert all other business processes.

Quite to the contrary, if information governance is planned and managed properly, information security controls end up being close parallels to, or integrated within, existing business processes. It is the establishment and maintenance of a connection between the organization's most valuable assets and the organization's control structure. Embracing governance concepts is the admission that we have assets we've ignored, and that there needs to be some sort of structure that makes information tangible, addressable and protected.

"We've got some rules around here"

When challenged to explain information governance to executives, it's easy to digress into academic and philosophical debates over the centrality of information in a business But that structure -- identifying information so that it's tangible and can be protected -- is the essence of governance. It's the explicit statement that there are rules about how people use processes and technology that affect or protect information.

The good news is that the concepts surrounding governance are becoming more easily understood as the professional dialogue and community body of knowledge becomes more mature and refined. A few years ago, one might have had to dig through the ISO 20000 (IT service management or "ITIL") and ISO 27001 (security management) standards to find the right words about establishment of a "management system;" to explain the desired governance framework for an information-heavy organization. Now there are numerous voices -- some better than others -- providing definitions and discussion on the topic.

More recently, respectable certifications have become available for professionals involved in the establishment or operation of information governance systems. For example, the US Information Systems Audit and Control Association (ISACA) is administering its first test for the Certification in the Governance of Enterprise IT () this year.

To measure is to know, as the adage goes, and as more people buy into these programs and refine the collective understanding, the closer we collectively get to Dan Geer's goal in Measuring Security (download PDF): "To move from a culture of fear to a culture of awareness and then a culture of measurement."