Security Fundamentals and Governance
Domain 1: Security Fundamentals and Governance
This domain tests whether you can connect security work to business objectives and show that controls are directed, owned, and measured. Expect questions on governance bodies, policy hierarchy, risk appetite and tolerance, roles and accountability, compliance obligations, third-party risk, and security metrics.
Core rules and concepts
- Governance sets direction: executive leadership approves risk appetite, assigns accountability, and funds controls. Security is a business function, not an IT-only activity.
- Policy hierarchy: policy states mandatory intent; standards specify requirements; procedures give step-by-step instructions; guidelines are recommended. A policy should be concise and approved at the right level.
- Risk appetite is the amount of risk leadership is willing to accept; risk tolerance is the acceptable variation around that appetite. Risk treatment options are mitigate, transfer, avoid, and accept.
- Control ownership: every control needs an owner, a test method, and evidence. Segregation of duties prevents one person from both approving and performing a sensitive action.
- Compliance is a floor, not a ceiling. Map obligations to controls once, then reuse evidence across audits.
- Third-party risk: classify vendors by data sensitivity and service criticality; require due diligence, contractual security terms, and ongoing review.
Worked example
A SaaS vendor will store customer PII. The business wants to sign quickly because the vendor is cheap. You classify the data as confidential, rate the vendor as high criticality, and require an independent assurance report, encryption at rest and in transit, breach notification, and a right to audit. Because residual risk exceeds appetite, you escalate to the risk owner. The owner accepts a time-bound exception with a compensating control: restricted data fields and enhanced monitoring. Reasoning: the decision is based on data sensitivity and business impact, not price; the exception has an owner, expiry, and evidence.
Traps that cost marks
Do not confuse policies with procedures. Do not say the security team owns all risk; business owners accept risk. Do not treat a passed audit as proof of effective security. Do not accept a vendor without ongoing monitoring. Do not create exceptions without expiry or approval.