CSG study guide
CSG · Work through your exam, one topic at a time.
The Certified Security Governance (CSG) credential is offered by The SecOps Group, a UK-headquartered IT security company that describes itself as having two business units: CREST-accredited security consultancy and pentesting exams. The SecOps Group states that through its exams it provides "an authentic and credible certification program that is up-to-date and represents real life business risks." The CSG is aimed at practitioners who own or advise on security governance rather than hands-on offensive testing: GRC analysts, security managers and officers, ISMS and compliance leads, internal auditors, and consultants who must translate business objectives into security direction and evidence. The CSG study guide has 4 sections and about 1,921 words.
01Security Governance
Security governance is the system of direction, accountability, and oversight that keeps an information security programme aligned with business objectives. The CSG exam tests whether you can separate governance from management, attach accountability to the right role, and explain how strategy, risk appetite, and performance reporting fit together.
516 words, about 3 min02Risk Management
Risk management is the disciplined process of identifying, analysing, treating, and monitoring risk to information assets so that exposure stays within the organisation's appetite. The CSG exam tests your command of risk terminology, the treatment options, quantification methods, and how risk registers and third-party risk feed governance decisions.
454 words, about 2 min03Compliance and Regulatory Requirements
Compliance is the state of meeting obligations imposed by law, regulation, contract, or adopted standard. The CSG exam tests whether you can identify which obligations apply, distinguish legally binding requirements from voluntary frameworks, map controls once to satisfy many obligations, and produce credible evidence.
472 words, about 2 min04Security Policies, Standards and Procedures
This domain covers the documented layer of the security programme: how intent becomes mandatory requirements, then repeatable steps. The CSG exam tests the document hierarchy, the lifecycle from drafting to retirement, exception handling, and why poorly written or unapproved documents fail audits.
479 words, about 2 min