Risk Management, Governance, and Compliance
Domain 7 - Risk Management, Governance, and Compliance
This domain tests risk assessment, treatment, governance structures, and compliance frameworks. Expect questions on risk scoring, control selection, and business continuity.
Core rules
- Risk is typically likelihood times impact. Qualitative scales are fast; quantitative methods estimate monetary loss.
- Risk treatment options: mitigate, transfer, avoid, accept. Acceptance must be documented by an accountable owner.
- Inherent risk exists before controls; residual risk remains after controls. Compliance is a floor, not proof of security.
- Governance defines roles, policy, and risk appetite. Risk appetite is the amount of risk leadership is willing to accept.
- Frameworks such as NIST CSF, ISO 27001, and CIS Controls structure programs.
- BIA identifies critical processes. RTO is the maximum tolerable downtime; RPO is the maximum tolerable data loss.
Worked example
A risk register entry: public web app with an unpatched critical vulnerability. Likelihood is high because exploitation is active; impact is high because customer data is exposed. Inherent risk is critical. Apply patching and WAF virtual patching; residual risk drops to medium. The business owner accepts the remaining risk with a review date. Compliance alone would not justify leaving it open.
Traps
Confusing RTO with RPO; treating residual risk as inherent risk; assuming a compliance certificate means no risk; and accepting risk without an accountable owner or review date.