Study guide 14: Security governance, change management and automation
Domain 5: Security Program Management & Oversight · Not started
Main exam topics
Governance, policies, standards and roles; risk assessment and treatment; vendor oversight; compliance and privacy; audits and assessments; security awareness; annualized loss expectancy = single loss expectancy × annual rate of occurrence.
SY0-701 topic overview · Independent study resource, not a prediction of exam questions.
Lesson plan · 60 minutes
By the end of this lesson you will be able to:
- Distinguish policies, standards, procedures and guidelines
- Describe governance boards, committees and data roles
- Follow a change management process with approvals and backout plans
- Weigh benefits and risks of automation and orchestration
Topic 14A — Policies and governance
Policies state management intent (acceptable use, information security). Standards set mandatory specifics (password length). Procedures give step-by-step instructions (onboarding, playbooks). Guidelines are recommendations. Governance can be centralized or decentralized, using boards and committees. Data roles: owner (accountable, classifies), controller (decides purpose), processor (handles on behalf), custodian/steward (day-to-day care).
Topic 14B — Change management
Changes are requested, assessed for impact, approved by a change advisory board, tested, scheduled in a maintenance window, and documented with a backout plan. Consider dependencies, downtime, service restarts, legacy applications and updating diagrams and policies afterward. Allow lists and deny lists define which changes are pre-approved.
Topic 14C — Automation and orchestration
Automation handles user provisioning, guardrails, ticketing and escalation, and enabling/disabling access. Benefits: efficiency, consistent baselines, faster reaction, workforce multiplier. Risks: complexity, cost, single point of failure, technical debt and ongoing support.
Saved