A company classifies security groups by risk level. Any group with a high-risk classification requires multiple levels of approval for member or…

The scenario describes a formal, rule-based system where changes to high-risk assets (security groups) are controlled through a multi-level approval workflow. This is a direct implementation of organizational governance, which encompasses the policies, rules, and processes an organization uses to manage and control its operations and reduce risk. While essential for security, these formal governance procedures can act as an inhibitor to rapid remediation because they intentionally introduce delays to ensure proper authorization and oversight. The approval process itself is the governance mechanism that inhibits immediate changes.

B. MOU: A Memorandum of Understanding (MOU) is a non-binding agreement between parties, not an internal control process for managing security group changes.

C. SLA: A Service Level Agreement (SLA) is a contract defining service performance metrics between a provider and a customer, unrelated to internal approval workflows.

D. Business process interruption: This is a potential negative consequence of a slow remediation process, not the inhibitor (the governance structure) that causes the delay.

1. National Institute of Standards and Technology (NIST) Special Publication 800-100

Information Security Handbook: A Guide for Managers

Section 2.2

"Information Security Governance." This section details how governance establishes the framework

policies

and processes (such as approval workflows) to manage information security risk.

2. National Institute of Standards and Technology (NIST) Special Publication 800-53 Revision 5

Security and Privacy Controls for Information Systems and Organizations

Control Family: Configuration Management (CM)

Control: CM-3

"Configuration Change Control." This control explicitly requires organizations to "approve or disapprove configuration change requests with a documented audit trail of the approval

" which is a core component of the organizational governance described in the question.

3. Carnegie Mellon University

Software Engineering Institute (SEI)

Governing for Enterprise Security (CMU/SEI-2007-TN-020)

Section 3.1

"Governance Defined." This document defines governance as the set of responsibilities and practices exercised by the board and executive management to provide strategic direction

ensure that objectives are achieved

and manage risks. The approval process is a direct exercise of this practice.