CSG common mistakes
CSG · Understand the traps and how to avoid them.
Treating governance as a synonym for compliance and answering 'compliance' whenever a question asks who is accountable for an outcome or how a decision gets escalated.
Governance and compliance vocabulary overlaps heavily in study material, so candidates collapse the two and miss the distinction between decision rights and obligation tracking. Governance questions usually hinge on accountability, oversight bodies, and escalation paths, not on meeting an external rule.
What to do instead
Before answering, ask: is this about who decides and who answers for the decision (governance), or about meeting a defined requirement (compliance)? Practice writing one-line definitions of each and tag every practice question with the domain it actually tests. When two options both sound correct, pick the one that assigns authority or defines an oversight mechanism.
Assigning ultimate accountability to the CISO, security steering committee, or an auditor instead of the business owner or accountable executive.
Security candidates work closest to the CISO and unconsciously treat that role as the top of every hierarchy. Exam scenarios deliberately place the CISO in an advisory or implementing role, and the correct answer is usually the data or process owner who accepts the residual risk.
What to do instead
Memorise the separation: owners accept risk, security advises and monitors, internal audit provides independent assurance, and the board or executive committee provides oversight. On any accountability question, identify who would bear the business consequence of failure, and choose that party rather than the security function.
Jumping to a technical control when the scenario asks for the first step in the risk management process, such as establishing context, defining risk criteria, or identifying assets and threats.
Technical training rewards solution thinking, so candidates read a risk scenario and immediately select the mitigating control. The exam often tests sequencing, and the correct first step is scoping and criteria-setting rather than treatment.
What to do instead
Drill the risk lifecycle order: establish context and criteria, identify, analyse, evaluate, treat, then monitor and communicate. For any 'first step' or 'next step' question, locate the scenario on that chain and choose the adjacent phase rather than the most impressive control.
Confusing inherent risk, current or residual risk, and target risk when reading a risk register scenario, then selecting a treatment that addresses the wrong figure.
The three values appear in the same row of a register and differ only by qualifying adjectives. Candidates skim and anchor on the largest number, which is usually inherent risk, and then propose controls that are already reflected in the current rating.
What to do instead
Read the qualifier in every risk question and restate it to yourself before looking at options. Remember that inherent risk is before controls, current or residual risk is with existing controls, and target risk is the acceptable level after planned treatment. If the gap is between current and target, the answer is additional treatment; if inherent and current are equal, controls are absent or ineffective.
Choosing to avoid, transfer, or accept risk when the scenario calls for mitigation, or treating insurance as eliminating risk rather than transferring the financial consequence.
Risk treatment options are taught as a list without decision criteria, so candidates pick the option that sounds most decisive. Transfer is especially misunderstood because insurance feels like removal of risk.
What to do instead
Apply the decision tests: avoidance only works if the activity can be stopped entirely; transfer shifts financial impact but not accountability or reputational exposure; acceptance must be explicit, documented, and at the right authority level; mitigation reduces likelihood or impact. Match the option to what the scenario says is constrained, such as cost, legality, or business continuity.
Assuming a regulation such as GDPR, HIPAA, or PCI DSS applies only to organisations headquartered in, or primarily operating from, a particular jurisdiction.
Candidates map regulations to countries rather than to data subjects, cardholders, or covered entities. Extraterritorial scope provisions and contractual flow-down requirements are easy to overlook in favour of a simple geographic rule.
What to do instead
For each major regulation, memorise the trigger rather than the country: whose data or transactions bring you into scope, and what the threshold is. Practise scenarios involving a non-local company serving local customers and confirm that scope follows the data subject or the payment channel, not the headquarters.
Treating frameworks and standards such as ISO 27001, NIST CSF, or COBIT as legally binding obligations, or conversely treating a regulation as optional guidance.
Study material presents frameworks, standards, and regulations side by side, and candidates lose track of which are mandatory, which are contractual, and which are voluntary good practice. Certification bodies and regulators reinforce the confusion by referencing each other.
What to do instead
Classify each instrument on three axes: who issued it, whether it is enforceable by law, and whether it becomes binding through contract or certification. Build a short table of the instruments named in your syllabus and label each as law, contractual requirement, certifiable standard, or voluntary framework, then test yourself on borderline cases such as a standard incorporated into a regulation.
Drafting a policy statement that mixes mandatory requirements with implementation detail, so the answer reads like a procedure or a guideline.
Candidates write from operational experience and include the how-to steps they know well. The exam distinguishes policy, standard, procedure, and guideline by purpose and level of detail, and a technically correct answer can still be wrong on document type.
What to do instead
Use the purpose test: policy states intent and mandatory expectations in broad terms; standard sets specific, measurable requirements; procedure gives step-by-step instructions for a task; guideline offers recommended practice. Before selecting an option, ask whether it says what must be achieved, how it must be configured, or how to perform the steps, and match that to the requested document type.
Approving or publishing a policy without an owner, review cycle, exception process, or communication plan, then calling it complete.
Candidates focus on content quality and treat the document as the deliverable. Exam scenarios test the full lifecycle, including endorsement by senior management, scheduled review, exceptions with expiry, and evidence of acknowledgement.
What to do instead
Memorise the policy lifecycle: draft, consult, approve at the right authority, communicate and train, enforce with exceptions, review on a defined cycle, and retire or revise. When a scenario asks what is missing, check for approval authority, review frequency, exception handling, and acknowledgement records before commenting on wording.
Answering an incident or exception scenario with 'escalate to management' or 'update the policy' without naming the specific artefact, authority, or record the process requires.
Generic escalation and policy-update answers feel safe, so candidates default to them when unsure. Exam writers include them as distractors because they are directionally right but fail to satisfy the control objective being tested.
What to do instead
Replace generic verbs with named outputs: a documented risk acceptance signed by the accountable owner, a time-bound exception with compensating controls, an incident report to the regulator within the stated window, or a change request through the change board. If an option says escalate, ask escalate to whom, about what, and with what record, and reject options that cannot answer all three.