Cyber Policy Fundamentals and Governance
What this domain tests
You need to speak the language of policy: the difference between strategy, policy, standard, and procedure, and who owns each. Strategy sets long-term direction; policy states mandatory management intent; standards define measurable requirements; procedures describe step-by-step execution. A frequent trap is a question that describes a technical control (e.g., "TLS 1.2 minimum") and asks what tier of the governance hierarchy it belongs to - the answer is a standard, not policy.
Know the governance bodies and their distinct roles. A governing body/board sets risk appetite and approves policy; executive management implements and funds it; a CISO/security function advises, defines controls, and reports; internal audit provides independent assurance and should not own or operate controls it audits. Questions that place audit inside the security team, or make the CISO the policy approver, are wrong.
Understand risk appetite vs. risk tolerance, accountability vs. responsibility (RACI), and the concept of three lines of defense: operational management (first), risk/compliance oversight (second), independent audit (third). Also expect items on policy lifecycle - draft, review, approve, communicate, train, measure, and refresh on a defined cadence or after significant change.
Trap: conflating "compliance" with "security." Passing an audit does not mean risk is acceptable; governance requires evidence that controls are effective, not merely present.
Rule of thumb: If a question asks who approves, answer with the governing body; if it asks who executes, answer with operational management; if it asks who verifies independently, answer with audit.