Governance, Compliance, and Security Operations
Governance, Compliance, and Security Operations
This domain tests the management layer: how policy, frameworks, metrics and continuity planning turn security activity into accountable, auditable operations.
Core rules
- Policy hierarchy: policy states intent and is mandatory; standards specify requirements; procedures give step-by-step instructions; guidelines are advisory.
- NIST Cybersecurity Framework 2.0 has six functions: Govern, Identify, Protect, Detect, Respond, Recover. Govern is the addition that elevates risk management to leadership.
- ISO 27001 defines an ISMS with risk treatment and Annex A controls; SOC 2 reports against trust services criteria; PCI DSS covers cardholder data; HIPAA covers protected health information; GDPR governs personal data and breach notification.
- A risk register records risk, owner, rating, treatment and review date. Without an owner it is a list, not a register.
- Business continuity and disaster recovery use RTO (how long until restored) and RPO (how much data loss is tolerable). Test them; an untested plan is an assumption.
- Third-party risk requires due diligence before onboarding and ongoing monitoring, not a one-time questionnaire.
Worked example
A board asks whether detection is improving. Map activity to the Detect function, then report a metric such as median time from first telemetry to validated alert, plus the percentage of ATT&CK techniques with at least one detection. Pair it with a coverage percentage for log sources. The metric shows trend and gap, and every figure traces back to a control and an owner.
Traps that cost marks
- Treating a compliance certificate as proof of security; compliance is a floor.
- Confusing policy (intent) with procedure (steps).
- Reporting activity counts such as alerts closed instead of outcome measures.
- Leaving RTO and RPO undefined until a real outage.