Governance, Risk, and Compliance Basics
Governance, Risk, and Compliance Basics tests the documents and decisions that steer security: policy, risk treatment, audits, and regulatory obligations. CJCA expects practical distinctions, not legal advice.
Core rules
- Policy states management intent and mandatory rules; standards specify requirements; procedures give step-by-step instructions; guidelines are recommendations.
- Risk assessment identifies assets, threats, vulnerabilities, likelihood, and impact. Risk treatment: avoid, mitigate, transfer, or accept. Acceptance is a documented business decision by an authorized owner.
- Common frameworks: ISO/IEC 27001 for an information security management system; NIST Cybersecurity Framework for identify, protect, detect, respond, recover; PCI DSS for cardholder data; GDPR for EU personal data; HIPAA for US health information.
- BCP/DR planning addresses continuity and recovery. Third-party risk reviews vendors and supply-chain dependencies. Data classification drives handling rules.
Worked example
A public web application has a known high-severity vulnerability, a public exploit, and internet exposure. Likelihood is high and impact is moderate, so the risk is high. The team patches within the emergency window (mitigate), adds a WAF rule as a compensating control, and accepts the residual risk for the short patch window with written approval from the system owner. Buying cyber insurance is risk transfer, not a fix. Deleting the finding from the register is not risk acceptance.
Traps
Compliance is not the same as security. A policy is not a procedure. Risk acceptance must be authorized and documented. PCI DSS applies to cardholder data environments, not every system. Do not treat a framework certification as proof that controls operate effectively.