Governance, Risk, and Compliance
Governance vs. management
Governance sets direction: policies, roles, risk appetite, and oversight from senior leadership. Management executes it. Questions frequently test the document hierarchy, so learn it cold: policy (mandatory statement of intent, approved at the top) → standard (mandatory, specific requirements such as "AES-256 at rest") → procedure (step-by-step instructions) → guideline (optional advice). Swap policy and standard in a question and you have the classic distractor.
Risk math
Quantitative risk uses two formulas: SLE = asset value × exposure factor, and ALE = SLE × ARO. Qualitative methods use ranked scales and are faster but less defensible. Risk treatment options are avoid, mitigate, transfer, and accept; "share" sometimes appears. Transfer (insurance, outsourcing, contract) never removes accountability - the organization still owns the residual risk.
Control vocabulary
Categories: technical, operational, managerial. Types: preventive, detective, corrective, deterrent, compensating, directive, recovery. A stem usually names a control with both dimensions available; choose based on what the control does.
Compliance and continuity
Know the scope of GDPR, HIPAA, PCI DSS, SOX, and GLBA, plus third-party risk tools (questionnaires, SOC 2 reports, right-to-audit clauses). Continuity: RTO is how fast a service returns; RPO is how much data loss is tolerable; MTD is the maximum outage before unacceptable harm. Also distinguish due care (doing the right thing) from due diligence (verifying it was done).
Worked example
Asset value $200,000, exposure factor 25% → SLE $50,000. ARO 0.5 → ALE $25,000. A control costing $10,000 per year that halves the ARO saves about $12,500 in expected loss, so it is justified - but residual risk remains and must be documented.
Trap to expect
"Risk was transferred, so we eliminated it" is always wrong.