Security and Privacy Governance, Risk Management, and Compliance Program
Security and Privacy Governance
Governance sets direction, management executes
Governance is the structure of decisions, accountability, and oversight that determines how much risk an organization will accept and who is allowed to accept it. Management is the execution layer that implements those decisions. Questions frequently blur the two: a governance body (board, executive risk committee) approves policy and risk appetite; managers implement and report.
The policy hierarchy
- Policy - mandatory, broad, states intent and why.
- Standard - mandatory, specific, measurable requirements (e.g., AES-256).
- Procedure - step-by-step instructions for performing a task.
- Guideline - recommended, discretionary.
Trap: a question describes a recommended practice and labels it a policy; or describes a technical setting and labels it a procedure.
Roles and accountability
Senior executives hold ultimate accountability; the CISO usually leads the program but often does not own system risk; the system owner is accountable for the system's controls and residual risk; data owners classify data and approve access; custodians implement. The three lines of defense are operations, risk/compliance oversight, and internal audit - audit must not be the same people who built the controls.
Privacy governance
Core principles: notice, choice/consent, purpose limitation, minimization, retention and disposal, accuracy, security, transparency, redress, and accountability. Privacy and security are distinct obligations - a well-encrypted system can still breach privacy law by collecting excessive data or lacking notice.
Trap: treating "we secured it" as privacy compliance, and confusing accountability (cannot be delegated) with responsibility (can be assigned).
Rule of thumb: when asked who owns a risk decision, look for the role with authority over the mission or business - not the person operating the scanner.
Measure the program with KPIs (effectiveness) and KRIs (exposure) reported upward on a fixed cadence.
Risk Management and Compliance Program
Risk is a decision input, not a checklist
Risk is a function of likelihood and impact. The lifecycle is identify, analyze, evaluate, treat, and monitor. Know the major structures: the NIST Risk Management Framework (prepare, categorize, select, implement, assess, authorize, monitor), ISO 31000, and the multi-tier view in NIST SP 800-39 (organization, mission/business process, system).
Appetite versus tolerance
Risk appetite is the amount and type of risk an organization is willing to accept in pursuit of objectives - a broad statement. Risk tolerance is the acceptable variation around that appetite, usually expressed as thresholds. Trap: questions that swap the two, or that describe acceptance of a single issue as "appetite."
Treatment options
Mitigate, transfer, avoid, accept. Distinguish inherent risk (before controls) from residual risk (after controls). Acceptance must occur at the authority level that owns the risk and must be documented with a rationale and often an expiry.
Building the compliance program
A credible program has a charter and scope, an inventory of obligations, mapped controls (crosswalks let one control satisfy many frameworks), evidence management, training and awareness, third-party due diligence, issue and POA&M tracking, governance reporting, and independent assurance.
Traps: equating compliance with security; assuming a control that passed an assessment is effective in operation; treating risk assessment as an annual-only event; letting the risk register become stale.
Rule of thumb: a risk statement should read cause → event → consequence. If you cannot write it that way, you are describing a concern, a control gap, or a finding - not a risk.
Keep scoring consistent (qualitative scales defined in advance) so results are comparable across systems and time.