A security steering committee works when it meets on a fixed schedule, has members who can commit budget and people, reviews a short set of numbers, and leaves every meeting with recorded decisions. If it only receives status updates, shrink it or cancel it.
Who should be in the room
Keep it to six to ten people. A typical mix is the CISO as chair, a senior sponsor from the executive team, and leaders from engineering, IT, legal, finance and one business unit. Add HR or procurement when the agenda needs them.
Membership should mean authority. If a member has to ask permission before agreeing, the decision will happen somewhere else.
Write a one page charter
Cover four points.
- Purpose. For example: set security priorities, resolve conflicts, approve risk acceptance above a defined level.
- Decision rights. What the committee can approve alone and what goes to the executive team or board.
- Cadence. Monthly for most firms, quarterly if the program is stable.
- Quorum and records. Who must attend, and where decisions are logged.
A forty five minute agenda
- Decisions needed (15 minutes). Put the asks first. Exceptions to approve, budget to release, policy changes.
- Metrics (10 minutes). Four to six measures, shown as trends. Examples: time to fix critical issues, share of systems covered by key controls, open exceptions past their expiry.
- Top risks (10 minutes). Only changes since last time.
- Upcoming (10 minutes). Audits, launches, vendor changes, incidents in the news that touch you.
Circulate a two page pre-read two days before. If people read it, the meeting can be about choices.
Keep a decision log
Record each decision as: what was decided, who owns it, due date, and the risk it addresses. Start each meeting by reviewing overdue items. This one habit turns a talking group into a managing one.
Handling disagreement
Steering committees exist partly to settle conflicts between security and delivery. Agree in the charter how a tie is broken. Often the executive sponsor decides, and the decision and its reasoning go in the log. People accept a loss more easily when they can see the reasoning and know the topic will be revisited with fresh data.
Signs it has gone wrong
- Members send delegates who cannot decide.
- The same risks appear every month with no movement.
- Metrics change definition without notice.
- Security presents and everyone else listens.
Fix this by trimming the agenda, naming owners outside security, and putting a date on every action.
Quick check
How often should a security steering committee meet?
Monthly is common while a program is building. Quarterly can work once it is stable, with a short escalation path in between.
Who should chair it?
Usually the CISO, with an executive sponsor who can resolve conflicts. Some firms rotate the chair to build business ownership.
Last reviewed: 19 October 2026.
