Cybersecurity Governance and Risk Management
What to know
Governance is about direction, accountability, and oversight: board and executive responsibility, a documented risk appetite, security strategy aligned to business objectives, and reporting lines that give leadership meaningful risk information. Candidates must know the risk management lifecycle - identify, assess, treat (accept, mitigate, transfer, avoid), monitor - and the difference between inherent risk (before controls) and residual risk (after controls). Understand qualitative vs. quantitative assessment, risk registers, key risk indicators, and the three-lines model: management owns risk, risk/compliance functions oversee, internal audit provides independent assurance.
Traps
Questions conflate risk owner (accountable business leader) with control owner (implements the control). Another trap: treating a vulnerability scan as a risk assessment, or a technical fix as governance. Watch for "accept" being chosen when the correct answer is "escalate to the risk owner for a documented acceptance decision." Also be alert to the idea that risk appetite is set by leadership, not by the security team alone.
Worked example / rule of thumb
A legacy server cannot be patched. The security team documents the exposure, proposes compensating controls, and quantifies residual risk; the business risk owner formally accepts it with a review date. Rule of thumb: security identifies and advises; the business owns and accepts risk; audit assures. Residual risk after treatment must still fall within appetite, or it escalates.
Exam focus
Expect scenarios asking who owns a decision, how residual risk is calculated, and which treatment option applies.