Network Security Governance, Risk, and Compliance
Governance Fundamentals
Governance sets direction: policies, standards, procedures, and guidelines. Know the hierarchy - policy (what/why), standard (mandatory specifics), procedure (how), guideline (recommended). Understand roles: senior management owns risk appetite; security teams implement; asset owners accept risk.
Risk Management
Know qualitative vs. quantitative risk (ALE = SLE × ARO), and the treatment options: mitigate, transfer, avoid, accept. Understand risk registers, assessments, and the difference between a threat, vulnerability, and risk in governance terms.
Compliance and Frameworks
Recognize common frameworks and their focus: ISO 27001 (ISMS), NIST CSF (identify/protect/detect/respond/recover), PCI DSS (card data), HIPAA (health data), GDPR (personal data/EU). Know the difference between a control framework and a certification, and the role of audits and evidence.
Worked Example / Rule of Thumb
If SLE is $10,000 and ARO is 0.2, then ALE = $2,000. Compare that to the annual cost of a control; if the control costs more than the ALE it reduces, acceptance or transfer may be rational. Rule: risk decisions are business decisions documented by the accountable owner.
Trap: confusing 'compliance' with 'security' - passing an audit does not prove low risk. Also, 'transfer' (insurance) does not eliminate risk; it shifts financial impact.