Governance, Risk, and Compliance
Governance, Risk, and Compliance
This domain tests whether you can connect security activity to business risk, choose the right framework for the question, and evidence compliance. Items often ask which framework, which risk treatment, or which policy tier a given statement belongs to.
Core rules and concepts
- Risk vocabulary: risk = likelihood × impact; inherent risk exists before controls, residual risk remains after. Treatment options are avoid, mitigate, transfer (insurance, contract terms), and accept - each with a named owner and a review date recorded in a risk register. Risk appetite is the amount the organization is willing to pursue; tolerance is the acceptable variance around it.
- Frameworks: NIST Cybersecurity Framework 2.0 organizes outcomes into six functions - Govern, Identify, Protect, Detect, Respond, Recover - and is voluntary and non-certifiable. ISO/IEC 27001:2022 is a certifiable management system standard; its Annex A holds 93 controls across organizational, people, physical and technological themes, and certification means the ISMS is operated, not that controls are perfect. CIS Critical Security Controls v8 lists 18 control groups with Implementation Groups 1–3 for prioritization. SOC 2 reports against trust service criteria for service organizations.
- Regulations: GDPR (lawful basis, data subject rights, 72-hour breach notification, fines to €20M or 4% of global turnover), HIPAA Security Rule safeguards and breach notification, PCI DSS v4.0 with 12 principal requirements covering cardholder data protection and third-party management, SOX IT general controls, NIS2 with a 24-hour early warning.
- Document hierarchy: policy states management intent and is mandatory and broad; standards specify mandatory requirements; procedures give step-by-step instructions; guidelines are recommended practice. Due care is doing what a reasonable organization would do; due diligence is documenting and maintaining it.
- Continuity: the business impact analysis sets RTO (how fast it must be back) and RPO (how much data loss is tolerable), which drive backup and DR design.
Worked example
A radiology system on an unsupported OS cannot be patched. It is scored and entered in the register: high inherent risk. Treatment is mitigation, not acceptance of the vulnerability itself - isolate it on its own VLAN, restrict access to named hosts via ACLs, add IPS signatures for the known flaws, deploy EDR in monitor mode, and confirm offline backups. Residual risk is scored lower, and the CIO signs a time-bound risk acceptance with a review date and an owner for migration. Reasoning: unsupported does not mean unmanaged; compensating controls plus documented acceptance is the defensible path.
Traps that cost marks
- Confusing policy with procedure, or claiming a guideline is mandatory.
- Asserting that NIST CSF certification exists, or that ISO 27001 certification guarantees security.
- Accepting risk verbally with no owner, no compensating control, no expiry.
- Treating a vulnerability assessment as a risk assessment; the former feeds the latter.