Security Governance and Risk Management
Security Governance and Risk Management asks how an organization directs security, assigns accountability, and decides which risks to treat. The exam tests policy hierarchy, risk assessment mechanics, control selection, and third-party oversight more than slogans.
Core rules
- Governance sets direction through policies (mandatory management intent), standards (specific requirements), procedures (step-by-step), and guidelines (advice).
- Risk = likelihood × impact. Qualitative methods rank scenarios; quantitative methods estimate monetary loss using SLE = asset value × exposure factor, ALE = SLE × ARO.
- Risk treatment is mitigate, transfer, avoid, or accept. Acceptance must be within risk appetite and documented by an accountable owner.
- Controls are preventive, detective, corrective, deterrent, recovery, or compensating; they are not the same as risk responses.
- Monitor residual risk after controls, and assess vendors throughout the lifecycle, not only at onboarding.
Worked example
A server room asset is valued at $500,000. A flood would destroy 40% of it, so SLE = $200,000. The flood is expected once in 25 years, so ARO = 0.04 and ALE = $8,000. A $3,000 sump pump reduces expected loss by 80%, saving $6,400 in ALE; the net benefit is $3,400 before operating costs, so the control is financially justified but still needs residual-risk acceptance.
Traps
Do not subtract the control cost from SLE. Do not call risk transfer elimination-reputation and regulatory risk often remain. Do not let a policy owner also be the sole risk acceptor without authority. Inherent risk is before controls; residual risk is after.