Cyber Resilience Strategy and Governance
What to know
Cyber resilience strategy and governance is about how leadership sets direction, allocates authority, and keeps security functioning through disruption. Candidates should be fluent in the distinction between governance (decision rights, accountability, policy, risk appetite) and management (execution of controls). Know the roles: board and executive oversight, a CISO's operating model, a steering committee, and three-lines-of-defense separation between operations, risk/compliance, and audit. Understand risk appetite and tolerance statements, how they cascade into standards, and how exceptions are approved and time-boxed.
Resilience concepts matter here: MTD, RTO, RPO, business impact analysis, and the difference between resilience (ability to keep delivering) and recovery (restoring after failure). Know the major frameworks by purpose, not memorized clause numbers: NIST CSF for lifecycle functions, ISO 27001 for a certifiable management system, COBIT for IT governance, and regulatory regimes for sector obligations. Also know policy hierarchy: policy > standard > procedure > guideline.
Traps
- Confusing accountability with implementation. The business owner accepts risk; security advises.
- Treating risk appetite as a single number rather than a set of statements by category.
- Assuming certification equals continuous compliance.
- Picking a framework by popularity when the question specifies a certifiable management system or a governance-of-IT focus.
Worked example / rule of thumb
A business unit wants to skip MFA on a legacy system. The correct path: document the exception, quantify residual risk, route to the risk owner at the right authority level, time-box it, add compensating controls, and log it for audit. Rule of thumb: whoever bears the loss owns the risk decision; security owns the advice and the monitoring.