Security Principles and Governance
Domain 1, Security Principles and Governance, tests whether you can connect security objectives to enforceable rules and accountable decision-making. Expect questions on the CIA triad, least privilege, separation of duties, defense in depth, policy hierarchy, risk appetite, and governance roles.
Core rules
- Confidentiality, integrity, and availability are separate objectives; a control that improves one can weaken another.
- Governance sets direction and accountability; management executes it. Policies are mandatory intent, standards are specific requirements, procedures are step-by-step instructions, and guidelines are optional advice.
- Least privilege and need-to-know limit access; separation of duties prevents one person from controlling a whole sensitive transaction.
- Exceptions require a named owner, business justification, compensating control, expiry date, and review. Risk acceptance is a documented decision, not an omission.
- Metrics should show control effectiveness and residual risk, not just activity counts.
Worked example
A payroll administrator can create vendors, approve payments, and change bank details. That is a separation-of-duties failure: one compromised account can divert funds. The fix is to split vendor creation, payment approval, and bank-detail changes across roles, add dual approval for bank changes, log all changes, and review access quarterly. The reasoning is to reduce single-person control over a high-impact transaction and make fraud require collusion or multiple failures.
Traps
Do not treat a policy as a procedure, or compliance as proof of security. Do not let a control owner approve their own exception. Do not confuse risk appetite with zero risk; governance requires explicit tolerance and escalation.