Security Policies, Compliance, and Governance
Security Policies, Compliance, and Governance tests whether you can turn an obligation into a documented, auditable control. Expect questions on hierarchy of documents, framework structure, and the difference between being compliant and being secure.
Core rules
- Document hierarchy: policy (management intent, mandatory, rarely changes), standard (specific mandatory requirements such as AES-256 for data at rest), procedure (step-by-step instructions), guideline (recommended, optional). Guidelines are not enforceable.
- Data classification drives handling: public, internal, confidential, restricted, each with storage, sharing, retention, and destruction rules.
- NIST Cybersecurity Framework 2.0 has six functions: Govern, Identify, Protect, Detect, Respond, Recover. Govern was added in 2.0 and covers risk appetite, roles, and supply-chain oversight.
- ISO/IEC 27001 specifies an information security management system with risk assessment, treatment, and continual improvement; the Annex A controls in the 2022 revision are organised into four themes.
- PCI DSS v4.0 applies to cardholder data environments and emphasises targeted risk analyses and authenticated internal scanning; GDPR governs personal data of EU residents with breach notification generally within 72 hours; HIPAA covers protected health information in the US.
- Governance artefacts: risk register, risk appetite statement, acceptable use policy, third-party risk assessments, and evidence retained for audit.
Worked example
A requirement says access must be revoked within 24 hours of termination. The policy states that access is removed promptly on separation. The standard defines 24 hours and names the systems in scope. The procedure has HR send a termination event to the identity provider, which disables the account and triggers a ticket for each downstream application. The control is tested monthly by sampling terminations against deprovisioning timestamps, and that report is the audit evidence. The mapping runs obligation, policy, standard, procedure, evidence, which is exactly what an assessor asks for.
Traps that cost marks
- Treating guidelines as mandatory and failing staff for deviating from them.
- Claiming compliance proves security; it proves a control set was evidenced on a date.
- Forgetting the Govern function when reciting CSF 2.0.
- Writing a policy with no owner, review cycle, or evidence trail.