Governance, Risk, and Compliance Frameworks
What to know
Governance is the decision-rights layer: who approves risk, who owns controls, and how exceptions are documented. Candidates must distinguish policies (management intent), standards (mandatory measurable requirements), procedures (step-by-step execution), and guidelines (recommended practice). Know the risk vocabulary: asset, threat, vulnerability, likelihood, impact, inherent risk, residual risk, risk appetite, and risk tolerance. Understand qualitative versus quantitative analysis (SLE = asset value × exposure factor; ALE = SLE × ARO) and why a control is justified when its annual cost is below the ALE reduction it produces.
Map frameworks to their purpose rather than memorizing logos: control catalogs for selection, maturity models for capability progression, and process frameworks for lifecycle management. Compliance is evidence-driven: control mapping, gap analysis, remediation tracking, and continuous monitoring. Third-party risk needs tiering, contractual security terms, right-to-audit clauses, and ongoing reassessment.
Traps
Questions often swap accountability with responsibility - the accountable executive owns the outcome even when execution is delegated. Another trap confuses residual risk acceptance (a business decision by the risk owner) with risk avoidance (stopping the activity). Watch for options that let IT or security "accept" risk on the business's behalf; that is almost always wrong. Also separate due care (acting on known risk) from due diligence (investigating and verifying).
Worked example
A server worth $200,000 has a 25% exposure factor against a flood with a 1-in-10-year return period. SLE = $50,000; ALE = $5,000. A control costing $3,000 per year that halves the loss frequency is justified: it saves $2,500 annually, so it is marginal - quantify before recommending.
Rule of thumb: the risk owner accepts risk; security advises and documents.