Study guide 15: Risk management, vendors and audits
Domain 5: Security Program Management & Oversight · Not started
Main exam topics
Governance, policies, standards and roles; risk assessment and treatment; vendor oversight; compliance and privacy; audits and assessments; security awareness; annualized loss expectancy = single loss expectancy × annual rate of occurrence.
SY0-701 topic overview · Independent study resource, not a prediction of exam questions.
Lesson plan · 75 minutes
By the end of this lesson you will be able to:
- Calculate SLE, ARO and ALE
- Choose risk responses: accept, avoid, mitigate, transfer
- Assess vendors and choose SLA, MOU, MSA, SOW, NDA and BPA
- Distinguish internal/external audits and pentest types
Topic 15A — Risk management
Identify, assess, analyze and respond. Quantitative: SLE = asset value × exposure factor; ALE = SLE × ARO. Qualitative uses high/medium/low heat maps. A risk register records risks, owners, and responses. Responses: accept (within appetite), avoid (stop the activity), mitigate (controls), transfer (insurance, contract). Appetite and tolerance guide decisions; BIA defines MTD, RTO, RPO, MTTR and MTBF.
Topic 15B — Vendor management
Perform due diligence and right-to-audit clauses, questionnaires and independent assessments. Watch for conflicts of interest and supply chain risk. Agreements: SLA (measurable service levels), MOU/MOA (intent between parties), MSA (master terms), SOW/WO (specific work), NDA (confidentiality), BPA (partnership terms).
Topic 15C — Audits and assessments
Internal audits and self-assessments support compliance; external audits and regulatory exams provide independent assurance. Penetration tests: known environment (full info), partially known, unknown environment (no info). Offensive, defensive and integrated (purple) teams; physical tests; reconnaissance can be passive or active. Attestation formally confirms compliance.
Know the difference: Risk responses
| Response | Meaning | Example |
|---|---|---|
| Accept | Live with it | Low-value kiosk risk |
| Avoid | Stop the activity | Retire an unsafe service |
| Mitigate | Reduce with controls | Add MFA |
| Transfer | Shift cost | Cyber insurance |
Saved