Governance, Risk, and Compliance
Domain 1 (Governance, Risk, and Compliance) tests whether you can set direction for a security program rather than run it: who decides, how risk is expressed in business and financial terms, and how legal, regulatory, and contractual obligations collapse into a single set of controls.
Governance architecture
- The board sets risk appetite; the CISO proposes a program that fits inside it and reports against it.
- Three lines of defense: operations (1st), risk and compliance oversight (2nd), internal audit (3rd, independent of management).
- Document hierarchy: policy (mandatory intent) then standard (quantified requirement, e.g., AES-256 for data at rest) then procedure (step-by-step) then guideline (advisory). Blurring policy and procedure is a classic drafting error.
- A security charter, delegated authorities, and a steering committee that includes business, legal, HR, and finance are the decision forums the exam expects you to name.
Risk management
- Risk is likelihood times impact. Qualitative scales triage; quantitative figures fund decisions: SLE = asset value x exposure factor; ALE = SLE x annualized rate of occurrence.
- Appetite is the amount of risk the organization chooses to pursue; tolerance is the acceptable variance around a defined limit or KRI. They are not synonyms.
- Treatment options are mitigate, transfer, avoid, and accept. Every accepted risk needs a named business owner, a rationale, an expiry date for any exception, and a scheduled review.
- One master control set mapped to ISO/IEC 27001, NIST CSF, GDPR, HIPAA, SOX, and PCI DSS prevents duplicated audits and contradictory evidence demands.
Worked example
A payment platform has an asset valued at $600,000, an exposure factor of 50%, and an annualized rate of occurrence of 1.5. SLE = $300,000 and ALE = $450,000. A tokenization plus WAF program costs $120,000 per year and is expected to reduce the rate to 0.4, giving an ALE of $120,000, a saving of $330,000. Net benefit is $210,000 per year, so the CISO presents the business case to the steering committee. The payment product owner, not the CISO, signs acceptance of the remaining $120,000 of residual risk, and the register records the owner and next review date.
Traps that cost marks
- Confusing risk appetite with tolerance, or letting the CISO act as risk owner.
- Treating compliance as the objective; it is a floor, and a compliant organization can still be compromised.
- Writing policies that merely restate legislation instead of defining measurable internal requirements.
- Granting a policy exception with no expiry date or compensating control.