Cyber Security Governance and Awareness
What this domain tests
Governance and Awareness covers the management system around security: who is accountable, which document says what, how risk is treated, and how people are trained and measured. Questions test the difference between governance and operation, and between policy and procedure.
Core rules and concepts
- Governance vs management: governance sets direction, risk appetite and accountability; management runs the controls day to day. Senior management remains accountable; it cannot delegate accountability to the CISO.
- Document hierarchy: policy states intent and mandatory rules; standards define specific requirements; procedures give step-by-step instructions; guidelines are recommended practice. A policy is not a procedure.
- Risk management cycle: identify assets and risks, assess likelihood and impact, treat (mitigate, transfer, avoid, accept), monitor and review. Risk owners accept risk in writing.
- Frameworks and law: ISO/IEC 27001 defines an information security management system (ISMS) with continual improvement; ISO/IEC 27032 addresses cybersecurity; NIST CSF organises identify, protect, detect, respond and recover. GDPR and similar laws impose breach notification and data protection duties.
- Awareness and culture: training must be role-based, repeated and measured. People need a simple route to report phishing, errors and lost devices without fear.
- Incident response and continuity: plans, roles, communication and testing. Business continuity and disaster recovery cover different time horizons.
- Third parties: supplier risk, contracts, access limits and review.
Worked example
A marketing team wants to store customer data in a new SaaS tool without security review. The correct response is not simply 'no'. The data owner classifies the data, the risk team assesses the supplier, the contract adds confidentiality and breach-notification terms, access is limited to the team, multi-factor authentication is required, and the exception is approved for a fixed period with review. This is governance in action: a documented decision, an accountable owner and compensating controls. Approving the tool with no review would be a compliance and data-protection failure.
Traps that cost marks
- Treating a procedure as a policy. Procedures change more often and sit below policy.
- Saying the CISO is accountable for all risk. Business owners own risk; security advises.
- Equating compliance with security. A compliant organisation can still be breached.
- Running awareness training once a year with no measurement.
- Forgetting breach notification timelines and supplier contracts.
- Assuming business continuity and disaster recovery are identical.