Governance, Risk, Compliance and Incident Response
What to Know
Governance defines who can change what, and how. Cover on-chain governance (token voting, delegation, quorum, timelocks) and off-chain processes (multisig councils, change advisory). Understand risks: vote buying, low participation, governance capture, and emergency powers. Map to frameworks such as NIST CSF functions (identify, protect, detect, respond, recover) and control catalogs like ISO 27001 and SOC 2 for service providers.
Compliance includes AML/KYC obligations for custodial and exchange services, sanctions screening, travel-rule data sharing, and privacy law tensions with immutable ledgers (data minimization, off-chain storage of personal data). Record retention and auditability matter.
Risk management uses asset inventories, threat models, risk registers, and third-party due diligence for bridges, oracles, and custodians. Quantify exposure by value at risk and likelihood.
Incident response follows preparation, detection, containment, eradication, recovery, and lessons learned. Blockchain specifics: preserve chain evidence, coordinate with validators and exchanges, use pause guardians, publish post-mortems, and manage disclosure responsibly.
Traps
- Treating token voting as equivalent to legal governance; both exist and can conflict.
- Assuming immutability forbids GDPR-style erasure; store personal data off-chain with references.
- Skipping lessons learned after recovery; the loop closes only with corrective actions.
- Confusing sanctions screening with transaction monitoring; they are distinct controls.
Rule of Thumb
For any scenario, ask who is accountable, what evidence exists, and what is the recovery path. Worked example: an exploit triggers the pause guardian, a multisig freezes the bridge, exchanges are notified, and a post-mortem drives a timelock and oracle change.
Study Focus
Practice mapping controls to NIST CSF functions and distinguishing preventive, detective, and corrective controls in incident narratives.