TR-C Domain 6: Security, Compliance, and Governance
TR-C Domain 6, Security, Compliance, and Governance, tests how obligations become governed controls and trustworthy evidence. Questions cover policy hierarchy, regulatory mapping, audit readiness, third-party risk, privacy requests, incident reporting, board reporting, and exception governance. The exam expects you to connect a legal or contractual requirement to a control, an owner, and evidence without confusing compliance with security.
Core rules
- Build a policy hierarchy: policy states intent, standards set requirements, procedures describe steps, and records prove operation.
- Map each obligation to a control and a test. Relevant sources include ISO/IEC 27001, NIST CSF, SOC 2 trust criteria, GDPR Article 32, and CIS Controls, but mapping must reflect the actual system and contract.
- Keep evidence produced during normal operations. Recreated or back-filled evidence weakens assurance and audit credibility.
- Govern third parties with due diligence, contractual security terms, ongoing monitoring, and exit plans. Vendor certification does not transfer your risk.
- Report risk in business terms: obligations, control status, incidents, exceptions, and remediation dates. Exceptions need approval, expiry, and escalation.
Worked example
A customer submits a data-subject access request. The privacy procedure defines identity verification, the data sources to search, the response deadline, and the approval path. The team logs the request, searches the CRM and support system, redacts third-party data, and responds within the contractual deadline. Evidence includes the request record, verification, search results, approval, and response. Governance reviews the trend quarterly and finds that support exports are manual; the resulting remediation adds an automated export with access logging.
Traps
Do not copy a policy without mapping it to controls and tests. Do not equate a compliance certificate with effective security. Do not fabricate or retrospectively create audit evidence. Do not ignore vendor, retention, or cross-border data obligations. Do not allow exceptions to become permanent by default, and do not report only green metrics while incidents or overdue remediation remain open.