Security Engineering - Ross Anderson
One of the strongest books for understanding security as a management and systems discipline: adversaries, economics, usability, assurance, governance, and secure systems development.
Governance
Governance, accountability, ownership, and operating context.
