Compliance, Risk, and Security Best Practices
What this domain tests
This domain checks whether you can connect controls to risk and compliance obligations without treating a checklist as security. Expect risk assessment, control types, frameworks such as PCI DSS, HIPAA, GDPR, ISO 27001, and NIST, plus evidence, change control, and third-party risk.
Core rules
- Risk is commonly assessed as likelihood times impact; a risk register records owner, treatment, and residual risk.
- Control types: preventive, detective, and corrective. Encryption is preventive; logging is detective; restore is corrective.
- Compliance is a baseline, not proof of security. Passing an audit does not mean no breaches are possible.
- Scope matters: PCI DSS scope can be reduced by segmentation, but segmentation must be tested and documented.
- Evidence must be current, attributable, and retained; screenshots without dates or owners are weak.
- Third-party risk requires due diligence, contractual security requirements, and ongoing monitoring.
Worked example
A team wants to reduce PCI scope by isolating the cardholder-data environment. Reasoning: segmentation can reduce scope only if it is effective. Verify firewall rules, VLAN boundaries, and access paths; test that non-card systems cannot reach the card environment; document the design and test results. If a shared jump host or flat network remains, scope is not reduced. The decision should be recorded with residual risk and reviewed after changes.
Traps
- Equating compliance with security.
- Treating risk assessment as a one-time exercise.
- Claiming segmentation without testing it.
- Missing evidence ownership and dates.
- Ignoring vendor and supply-chain risk.