Security Program Management and Oversight
Governance and policy hierarchy
Governance sets direction. Policies state mandatory high-level intent; standards are specific mandatory requirements; procedures are step-by-step instructions; guidelines are recommendations. Typical policies cover acceptable use, data classification, and incident response. Know the roles: senior leadership owns the program, the CISO runs it, the data owner classifies data and accepts risk, and the data custodian or steward implements the controls.
Risk management
Risk is likelihood times impact. Identify assets and threats, assess qualitatively or quantitatively (SLE × ARO = ALE), record findings in a risk register, then treat. Handling options are mitigate, transfer, avoid, and accept. Risk appetite is how much risk leadership wants to take; risk tolerance is the acceptable variation around that. A business impact analysis identifies critical functions with their RTO and RPO and is owned by the business, not IT.
Third parties and compliance
Vendor due diligence plus right-to-audit clauses; agreement types include SLA (service levels), MOA/MOU (stated intent), BPA (partnership), NDA (confidentiality), and MSA/SOW (work terms). Regulations such as GDPR, HIPAA, PCI DSS, and SOX create obligations; a SOC 2 report is an independent attestation, not a certification you can claim.
Oversight activities
Distinguish audits (independent verification against criteria), assessments (internal review), and penetration tests (authorized exploitation). Awareness training with phishing simulations, tabletop exercises, and BC/DR plan tests validate readiness, and metrics demonstrate the program works.
Rule of thumb: when a question asks who decides how sensitive data is classified and who accepts the residual risk, the answer is the data owner - not IT and not the security team.