Governance, Compliance and Privacy
This domain tests the accountability layer: the policy hierarchy, who owns what, how third parties are overseen, and the privacy obligations that constrain technical choices.
Core rules and concepts
- Document hierarchy: policy states management intent and is mandatory; standards set mandatory specifics (for example, AES-256 for data at rest); procedures give step-by-step instructions; guidelines are recommended. Policies are executive-approved and reviewed on a cycle.
- Roles: the board and CISO set risk appetite. The data or asset owner is accountable for classification and access decisions; the custodian operates the controls; the steward handles data quality. Security is accountable for controls; the business owns the risk.
- Frameworks: ISO/IEC 27001 (certifiable ISMS), NIST CSF (govern, identify, protect, detect, respond, recover), CIS Controls, SOC 2 (attestation against trust criteria), PCI DSS for cardholder data. Compliance is a floor, not proof of security.
- Third-party risk: tier vendors by data access and criticality, apply due diligence, contractual security and breach-notification clauses, a right to audit, and ongoing monitoring.
- Privacy principles: lawful basis (consent, contract, legitimate interest, legal obligation), purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, accountability.
- Data subject rights: access, rectification, erasure, restriction, portability, objection, answered within statutory deadlines.
- Breach notification: under GDPR, notify the supervisory authority within 72 hours of becoming aware where rights are at risk, and affected individuals without undue delay where risk is high. Cross-border transfers need a mechanism such as adequacy or SCCs; high-risk processing needs a DPIA.
Worked example
Marketing buys an email list and wants to onboard it. There is no lawful basis: purchased lists lack valid consent, and legitimate interest needs a documented balancing test plus a working opt-out. The better path is a consent-based campaign with a clear notice, only the fields actually needed, a defined retention period, and recorded consent evidence. If the campaign profiles individuals, complete a DPIA. Record the decision in the risk register with the DPO's sign-off. This is a governance answer, not a firewall answer.
Traps that cost marks
- Equating a compliance certificate with being secure.
- Confusing a policy with a procedure, or a standard with a guideline.
- Assuming IT owns data risk when the business data owner is accountable.
- Starting the 72-hour clock at technical discovery instead of at awareness of a reportable breach.