Information Security Governance and Risk Management
What the exam tests
CISSO governance items ask you to connect business objectives to security decisions: who owns risk, how policy is structured, and how risk is measured, treated, and reported. Expect role questions (board, CISO, risk owner, control owner, auditor), policy-hierarchy questions (policy, standard, procedure, guideline), and quantitative risk math.
Core rules
- Accountability stays with the business. The security officer advises, measures, and monitors; the asset or process owner accepts residual risk.
- Risk appetite vs. tolerance. Appetite is the amount of risk the organization is willing to pursue; tolerance is acceptable variation around a specific risk limit.
- Risk treatment: mitigate, transfer, avoid, accept. Acceptance must be documented, time-bound, and made at the right authority level.
- Quantify with SLE = AV × EF and ALE = SLE × ARO. Report residual risk after controls, not inherent risk alone.
- Policy is mandatory and short; standards are specific and measurable; procedures are step by step; guidelines are recommended.
Worked example
An asset is valued at $200,000; exposure factor is 25%; the threat occurs twice a year. SLE = $50,000; ALE = $100,000. A control costing $30,000 per year reduces frequency to once every two years. New ALE = $50,000 × 0.5 = $25,000. Risk reduced = $75,000; net benefit = $75,000 − $30,000 = $45,000. Recommend the control and record the remaining $25,000 as residual risk for the asset owner to accept.
Traps
- Calling the CISO the risk owner. The CISO owns the program, not every business risk.
- Mixing up ARO (annual rate of occurrence) with a probability percentage.
- Presenting a control's cost saving without residual risk.
- Accepting risk verbally with no expiry or authority.