Governance, Risk, Compliance, and Ethics
Domain 9 covers governance, risk, compliance, and ethics. Expect policy hierarchy, risk assessment, regulatory obligations, third-party risk, and professional conduct.
Core rules and concepts
- Governance sets direction: policies are management intent, standards are mandatory requirements, procedures are step-by-step, and guidelines are advice.
- Risk assessment identifies assets, threats, vulnerabilities, likelihood, and impact; then treats risk by avoiding, mitigating, transferring, or accepting it.
- Compliance frameworks include ISO/IEC 27001, NIST CSF, PCI DSS, HIPAA, and GDPR. Compliance is a baseline, not proof of security.
- Third-party risk requires due diligence, contractual security terms, and ongoing monitoring.
- Ethics includes confidentiality, integrity, conflicts of interest, lawful handling of data, and responsible disclosure. Report suspected breaches through proper channels.
Worked example
Marketing wants to email a purchased contact list. Check consent and lawful basis under GDPR, data minimization, opt-out, retention, and vendor contracts. If consent is absent, do not send; propose a compliant opt-in campaign. Reasoning: a policy document does not create legal permission; the data subject's rights and the organization's obligations govern.
Traps that cost marks
Treating compliance as security. Confusing policies with procedures. Ignoring third-party risk because a contract exists. Assuming ethics is only about legality. Disclosing a vulnerability publicly before coordinated remediation.