Information security risk is of concern to both researchers and practitioners. In this study, we investigate the antecedents of optimal information security investment from organizational perspective using the concept of information technology governance. Specifically, we examine how board attributes including IT savviness, board duality, experience, and functional debate along with an organizational attribute, digital maturity, influence optimal information security investments. Data was collected from board members in organization to test the research model. Our results offer both theoretical and practical implications.