Cybersecurity Governance, Law, and Compliance
What to know cold
Governance is about direction, oversight, and accountability. Be able to distinguish policies (management intent), standards (mandatory specifics), procedures (step-by-step), and guidelines (recommended). Know the roles: board and executive management set risk appetite; the CISO advises and operates; data owners classify and authorise; data custodians implement; internal audit provides independent assurance. Understand the major legal and regulatory families - data protection and privacy law, sector regulation, breach-notification duties, and contractual obligations - and the difference between compliance (meeting a requirement) and security (managing risk). Know that compliance is a floor, not a ceiling.
Traps that show up in questions
- Assuming certification equals security; an audit samples evidence at a point in time.
- Confusing the data owner (accountable, business) with the custodian (technical).
- Choosing "the regulator" or "the auditor" when the question asks who accepts residual risk - that is management.
- Treating a policy as a technical control; a policy is a document that drives controls.
- Ignoring jurisdiction: an obligation may follow the data subject, not the server location.
Rule of thumb
Ask "who is accountable, who implements, and who assures?" If a stem names an action, assign it to owner, custodian, or audit before selecting an answer.
Worked example
A team wants to store customer records in a new region. The data owner approves the business use and classification; the custodian configures encryption and access; legal confirms cross-border transfer rules; internal audit later verifies. Choosing "the cloud provider ensures compliance" is wrong - accountability stays with the organisation.