Security, Risk and Compliance in Service Management
This domain tests how security, risk and compliance are built into service management rather than bolted on. Expect the CIA triad, identity and access management, vulnerability and patch management, risk assessment and treatment, supplier risk, compliance obligations and incident response.
Core rules and concepts
- Confidentiality, integrity and availability are the core security properties. Controls should map to the property they protect.
- Least privilege and separation of duties limit blast radius. MFA and strong identity lifecycle controls reduce credential risk.
- Risk is commonly assessed as likelihood x impact. Treatment options are avoid, mitigate, transfer and accept.
- Risk acceptance must be made by someone with authority and recorded with a review date.
- Compliance is not the same as security. Passing an audit does not prove resilience.
Worked example
A team wants to adopt a SaaS tool holding personal data. They classify the data, assess the supplier, require a data processing agreement, enforce SSO and MFA, define retention and deletion, review export and exit options, and record residual risk with an owner. The reasoning is that supplier risk and data protection are service design decisions, not procurement paperwork.
Traps
Treating security as the IT team's problem alone; assuming compliance equals security; accepting risk without authority; logging events but never monitoring them; ignoring supplier and exit risk.