Information is one of the most important assets in Organizations worldwide. To enable secure business operations, an organization must have an effective security governance strategy. The study focused on Information security governance in Public Universities in Kenya by establishing the current status of information security practices. Purposive sampling used to select seven (7) public Universities. A descriptive survey design, involving questionnaire was conducted to collect quantitative data. 394 respondents participated in the study. Data was analyzed using SPSS software. Correlation and multiple Regression analysis were obtained. The findings reveal that information security management’s participation level is inadequate to deal effectively with information security governance threats, roles and responsibilities not well defined in support of information security governance practices. The research provides a comprehensive model for ensuring alignment of information security objectives with business objectives.