Governance, Risk, and Compliance
What this domain tests
Governance, Risk, and Compliance tests how security is directed, measured, and evidenced. Expect policy hierarchy, risk appetite, control frameworks, audit evidence, third-party risk, data classification, and breach-notification obligations.
Core rules
- Policies state management intent; standards specify mandatory requirements; procedures describe steps; guidelines are recommended practices.
- Risk appetite is the amount of risk leadership accepts; risk tolerance is the acceptable variation around it.
- ISO/IEC 27001 specifies an information security management system; SOC 2 reports on trust services criteria; PCI DSS applies to cardholder data; HIPAA covers protected health information in the US; GDPR governs personal data and requires notification to a supervisory authority without undue delay and where feasible within 72 hours.
- NIST CSF 2.0 has six functions: Govern, Identify, Protect, Detect, Respond, Recover.
- Compliance is not security: passing an audit does not prove resistance to attack.
Worked example
A SaaS vendor asks to store customer data. Classify the data, assess the vendor's SOC 2 report and scope, require encryption and breach notification in the contract, and record the residual risk with an owner. Store the evidence so an auditor can trace requirement to control to test result.
Traps that cost marks
- Treating a policy as a procedure or a guideline as mandatory.
- Assuming a SOC 2 report covers the whole company when it has a defined scope.
- Equating compliance certification with effective security.
- Missing that GDPR and HIPAA have different scope and notification rules.