Governance, Risk and Compliance
Domain 1 - Governance, Risk and Compliance
This domain tests whether you can direct security through accountable governance, consistent risk decisions, and traceable compliance obligations. The exam expects you to connect board oversight to operational evidence, not just recite frameworks.
Core rules and concepts
- Governance defines decision rights: who owns risk, who accepts it, and who assures it. A common model separates executive ownership (first line), independent risk and compliance (second line), and internal audit (third line).
- Risk appetite is the amount and type of risk the organization is willing to pursue; risk tolerance is the acceptable variation around a specific objective. Document both, then enforce them in exception handling.
- Compliance is an outcome of mapped obligations (laws, contracts, standards such as ISO/IEC 27001 or NIST CSF) to controls. Map once, reuse evidence, and track changes in the obligation register.
- Report leading and lagging indicators: control failures, overdue treatments, exception ageing, and third-party risk. Tie metrics to business services.
Worked example
A legacy billing application cannot be patched and holds customer payment data. The risk team rates likelihood high and impact high. The CISO rejects a blanket acceptance because it exceeds the stated appetite for regulated data. Instead, the team proposes network segmentation, tokenization of card data, enhanced logging, and a funded replacement within nine months. The risk committee accepts the residual risk with a time-bound exception and monthly KRI review. Reasoning: acceptance is valid only within appetite, with compensating controls and an owned remediation date.
Traps that cost marks
- Treating risk appetite as a numeric maximum rather than a directional statement with tolerances.
- Equating a compliant control with an effective control.
- Allowing risk ownership to sit with the CISO instead of the business service owner.
- Reporting activity counts without residual-risk trends.