Security and Risk Management: Governance, Quantified Risk, and Business Continuity
What this domain tests
Domain 1 is the governance layer of the GISP blueprint. Questions probe whether you can connect business objectives to controls, express risk in terms a budget owner can act on, document who accepted which residual risk, and keep continuity planning aligned to real recovery limits. Ethics and professional conduct also sit here.
Core rules
- The CIA triad is the yardstick for every control. Classify controls as preventive, detective, corrective, deterrent, or compensating, and know that compensating controls reduce risk without removing the root cause.
- Quantitative risk: SLE = asset value × exposure factor; ALE = SLE × annualized rate of occurrence (a frequency per year, not a percentage). Qualitative methods use ordinal scales, risk matrices, and Delphi-style expert consensus.
- Treatment options are mitigate, transfer, avoid, and accept. Transfer (insurance, contract clauses) shifts financial impact, never accountability. Acceptance requires documented sign-off from the business owner who holds the risk.
- Governance hierarchy: policy states mandatory management intent; standards set mandatory specifics; procedures give mandatory step-by-step actions; guidelines are recommendations. A baseline is the minimum mandatory configuration.
- The NIST Risk Management Framework runs prepare, categorize, select, implement, assess, authorize, and monitor, and monitoring loops back continuously rather than ending at authorization.
- The BIA derives the maximum tolerable downtime; RTO must not exceed MTD, and RPO expresses tolerable data loss. BCP covers the whole business; DRP covers technology recovery.
Worked example
A file server is valued at $200,000, a successful event destroys 40% of its value, and events occur about every two years. SLE = $80,000; ALE = $80,000 × 0.5 = $40,000. A proposed control costs $15,000 per year and cuts occurrence to once every ten years: new ALE = $80,000 × 0.1 = $8,000, a $32,000 annual reduction that exceeds the $15,000 cost, so the control is economically justified. The residual $8,000 ALE still needs written acceptance by the data owner.
Traps that cost marks
- Entering ARO as a percentage, or multiplying SLE by an exposure factor twice.
- Letting IT silently absorb risk that belongs to a business owner.
- Writing an RTO longer than the MTD, or setting an RPO with no data-loss discussion.
- Answering "procedure" where the scenario describes a high-level mandatory statement, which is a policy.