Risk Management, Compliance, and Governance
Risk Management, Compliance, and Governance
This domain tests how security decisions are justified, documented, and audited. Expect questions on risk assessment, risk treatment, risk registers, business impact analysis, recovery objectives, control frameworks, third-party risk, and compliance obligations.
Core rules
- Quantitative risk uses asset value (AV), exposure factor (EF), single loss expectancy (SLE = AV x EF), annualized rate of occurrence (ARO), and annualized loss expectancy (ALE = SLE x ARO). Qualitative risk uses scales such as high/medium/low.
- Risk treatment options are avoid, mitigate, transfer, and accept. Acceptance must be documented by an accountable owner with authority.
- A risk register records description, owner, likelihood, impact, rating, treatment, and residual risk.
- BIA identifies critical processes and sets RTO (time to restore) and RPO (acceptable data loss). These drive backup and continuity design.
- Governance defines policies (intent), standards (requirements), procedures (steps), and guidelines (advice).
- Frameworks include NIST CSF, ISO/IEC 27001, SOC 2, PCI DSS, HIPAA, and GDPR. They overlap but have different scope and evidence.
Worked example
An asset is valued at $200,000, exposure factor 25%, so SLE = $50,000. ARO is 0.4, so ALE = $20,000. A control costs $8,000 per year and reduces ARO to 0.1, making ALE $5,000. The control saves $15,000 in expected loss and yields a net benefit of $7,000. The reasoning: compare control cost with reduced ALE, not with the asset value; also consider non-financial risk such as reputation and regulatory exposure.
Traps
- Claiming compliance equals security; an auditor samples controls, an attacker does not.
- Accepting risk without a named owner and documented rationale.
- Confusing RTO and RPO: RTO is downtime tolerance, RPO is data-loss tolerance.