Governance and policies
Domain 5: Security Program Management & Oversight · Not started
Main exam topics
Governance, policies, standards and roles; risk assessment and treatment; vendor oversight; compliance and privacy; audits and assessments; security awareness; annualized loss expectancy = single loss expectancy × annual rate of occurrence.
SY0-701 topic overview · Independent study resource, not a prediction of exam questions.
The document hierarchy
Policies state management's intent and are high level, such as requiring data to be protected. Standards set mandatory specifics, such as AES-256 for stored data. Procedures give step-by-step instructions. Guidelines are recommendations that are not mandatory. When a question asks which document tells staff exactly how to do something, choose a procedure.
Common policies
An acceptable use policy defines permitted use of systems. Information security, password, change management, incident response, and business continuity policies set expectations across the organization. Change management requires requests, impact analysis, approval, testing, a backout plan, and documentation before changes are made.
Roles
The data owner is accountable for a data set and decides classification and access. The data custodian implements controls day to day. The data controller decides why and how personal data is processed; the processor handles it on the controller's behalf. Governance boards and committees oversee the program.
Awareness
Security awareness training and phishing simulations reduce human risk. Track completion and results, and tailor training to roles such as finance staff targeted by payment fraud.
Know the difference: Policy vs. standard vs. procedure
| Document | Purpose | Example |
|---|---|---|
| Policy | Intent | Protect customer data |
| Standard | Mandatory specifics | Use AES-256 at rest |
| Procedure | How-to steps | Steps to enable disk encryption |
Saved