Security, Compliance, and Governance
This domain separates three ideas that questions deliberately blur: security is the technical and operational protection of assets; compliance is demonstrable adherence to external requirements; governance is the decision-making structure, policies, and accountability that direct both.
Security fundamentals
Anchor on the CIA triad - confidentiality, integrity, availability - and on AAA: authentication (who you are), authorization (what you may do), accounting (what you did, retained as audit logs). Apply least privilege, defense in depth, and separation of duties. Protect data in transit (TLS) and at rest (disk or object encryption), and know that encryption is not access control: an authorised user with a valid key still reads the data.
Shared responsibility
In any hosted model, the provider secures the platform and the customer secures identity, configuration, access, and data. Most real-world exposures are customer-side misconfiguration, not provider breach.
Governance and compliance mechanics
Governance artefacts form a hierarchy: policy (intent) → standard (mandatory specifics) → procedure (steps) → guideline (advisory). Data classification drives handling, retention, and disposal rules. Compliance frameworks supply control objectives that you map to technical controls and evidence; vendor and third-party risk assessment extends the same logic to suppliers.
Traps
- Compliance does not equal security - passing an audit means controls were evidenced at a point in time.
- Confusing authentication with authorization in scenario questions.
- Assuming the provider's certification covers the customer's own configuration.
- Ignoring log retention and auditability when discussing monitoring.
Worked example
A question describes a public storage bucket containing customer records. The provider is not at fault: the shared responsibility model places bucket policy, access control, and encryption choice with the customer. The answer involves least-privilege policy, classification-driven access, logging, and a governance control that prevents recurrence.