CGSP common mistakes
CGSP · Understand the traps and how to avoid them.
Treating governance as a synonym for management: answering that the executive team 'runs' the security programme and owns the controls, rather than recognising the governing body sets direction, risk appetite and oversight while management executes.
Candidates carry over private-sector habits where the CISO or CIO is assumed to be the final authority, and the exam's governance vocabulary (board accountability, direction-setting versus execution) is not drilled in day-to-day work.
What to do instead
For every governance scenario, explicitly separate three layers: who sets appetite and direction (governing body), who decides and oversees (executive/steering), who implements and reports (management). Practice rewriting each answer so the accountable party is the board or equivalent, and the responsible party is management.
Choosing a control response when the question asks for a governance response, or vice versa. For example, answering 'deploy DLP' to a question about how the organisation should decide whether customer data may be transferred offshore.
Technical candidates default to the tool they know, and the stem's scenario detail (a breach, a new cloud service) triggers solution-mode thinking before the actual ask is parsed.
What to do instead
Underline the interrogative in each stem before reading options: 'who should decide', 'what should be documented', 'which principle applies'. If the stem asks about authority, documentation or direction, eliminate any option that is purely a technical control.
Treating risk as a single number. Candidates pick the highest-likelihood or highest-impact option instead of applying the organisation's stated risk appetite and tolerance, or they fail to notice that a risk has been accepted at the correct authority level.
Risk scoring is often taught as a matrix exercise, so candidates rank risks rather than evaluate them against appetite, and they overlook that acceptance must sit with the accountable owner.
What to do instead
In every risk question, first locate the stated appetite or tolerance in the stem. Then ask three questions: is this within appetite, who is authorised to accept it, and has it been recorded? Options that escalate a within-appetite risk, or accept a risk above the responder's authority, are usually wrong.
Confusing risk treatment options. Candidates label transferring a risk as 'mitigating' it, or describe avoiding a risk when the organisation has merely reduced its likelihood through a control.
The four treatments (avoid, reduce/mitigate, transfer, accept) overlap in practice, and insurance or contract clauses are casually called 'mitigation' in workplace language.
What to do instead
Memorise the distinguishing test for each: avoid removes the activity; reduce changes likelihood or impact; transfer shifts financial consequence (insurance, indemnity) but not accountability; accept retains the risk with documented authority. For each scenario, name the treatment and then state what remains with the organisation.
Answering information security questions with a compliance lens: stating that a control is adequate because an audit passed, or that a certification demonstrates security, rather than assessing whether the control actually addresses the threat.
Audit evidence and certification language is familiar and reassuring, and candidates conflate 'audited' with 'effective' or 'secure'.
What to do instead
When a stem mentions a passed audit or certification, treat it as evidence of process, not outcome. Ask what threat or vulnerability the control addresses and whether the evidence proves it operates effectively. Options that equate certification with security should be eliminated.
Applying a lawful basis for processing without checking whether it is the right one for the context, for example defaulting to consent for employee data or to legitimate interests for special-category data.
Consent is the most familiar basis and appears in most consumer-facing examples, so it becomes a reflex answer even where it is inappropriate or invalid (imbalance of power, withdrawal difficulty).
What to do instead
Build a short decision routine: identify the data category, the relationship (employee, customer, vulnerable person), and whether the processing is necessary. Then test the candidate basis against appropriateness and the ability to withdraw. Never select consent where refusal is not genuinely free.
Confusing the roles and obligations in a data governance framework: attributing data ownership to the IT team, or assigning data quality remediation to the data owner when it belongs to the data steward.
Job titles vary across organisations, and candidates map exam terms onto their own workplace titles rather than the exam's defined roles.
What to do instead
Write out the exam's role definitions once and keep them visible: owner (accountable for a domain, quality and access decisions), steward (executes quality and metadata tasks), custodian (technical storage and protection). For each scenario, ask who is accountable versus who performs the work, and choose the accountable role only where accountability is asked for.
Treating incident response as a purely technical sequence and skipping the notification, evidence-preservation and lessons-learned obligations, or notifying regulators before internal escalation and containment.
Candidates focus on the exciting part (containment, forensics) and underestimate the procedural obligations that carry legal deadlines and are heavily tested.
What to do instead
For every incident scenario, run a fixed checklist: detect and confirm, contain, preserve evidence, assess notification duties and deadlines, escalate internally to the accountable owner, communicate, then review. Where timing matters, choose the option that preserves evidence and meets the earliest mandatory obligation without premature disclosure.
Missing independence and objectivity failures in assurance scenarios: accepting an audit performed by the team that built the control, or accepting management's self-assessment as sufficient assurance.
In small organisations self-assessment is normal practice, so candidates do not flag it, and 'the team reviewed its own work' sounds efficient rather than deficient.
What to do instead
In assurance questions, identify who performed the work and who is providing the conclusion. If they are the same party, or if the reviewer reports to the person being reviewed, treat the assurance as compromised and select the option that restores independence (external review, separate function, reporting line to the governing body).
Answering ethics scenarios with the legally permissible option rather than the professionally appropriate one, or escalating to a regulator or the press before exhausting internal channels.
Candidates equate 'not illegal' with 'acceptable', and in dilemmas they jump to the most dramatic remedy because it feels decisive.
What to do instead
Apply a staged ethics routine: is it lawful, is it consistent with the code of conduct, who is affected, and what is the least drastic effective action? Choose internal escalation (line management, then the appropriate function or committee) before external disclosure, and reserve external reporting for cases where internal channels are exhausted or compromised.