Governance, Risk, and Compliance
What this domain tests
Governance, Risk, and Compliance tests whether you can connect security work to business risk, policy, and evidence. Expect questions on risk assessment, risk registers, frameworks, third-party risk, exceptions, data classification, and audit readiness.
Core rules and concepts
- Risk = likelihood × impact, expressed against business objectives. Record inherent risk, controls, residual risk, owner, and treatment decision.
- Risk appetite and tolerance define what the organization may accept; exceptions must be time-bound and approved by the right authority.
- Frameworks such as NIST CSF, ISO/IEC 27001, and SOC 2 provide structure and evidence expectations; they do not replace judgment.
- Compliance is not security. A passing audit can coexist with exploitable weaknesses; use control testing and metrics to show effectiveness.
- Third-party risk requires due diligence, contractual security terms, ongoing monitoring, and exit planning.
- Data classification drives handling, retention, access, and privacy obligations.
- Audit evidence should be current, attributable, and reproducible: policies, logs, tickets, approvals, and test results.
Worked example
A vendor handling regulated customer data lacks SOC 2 but has an ISO/IEC 27001 certificate and a recent penetration test. The team documents the gap, obtains the test summary and remediation evidence, adds breach notification and audit-rights clauses, limits data scope, and sets a six-month review. The risk owner accepts residual risk with an expiry date. This is stronger than accepting the vendor because of a logo, and more honest than claiming zero risk.
Traps that cost marks
Treating certification as proof of security; accepting risk without an owner or expiry; ignoring third-party and supply-chain risk; and producing audit evidence that cannot be tied to the control period.
Exam-ready summary
Name the risk, the control, the residual risk, the owner, and the evidence.