Security Governance, Risk, and Compliance
Core ideas
Governance sets direction: policies, standards, procedures, and guidelines. Policies are management intent (mandatory), standards are specific requirements, procedures are step-by-step, guidelines are recommendations. Risk management identifies, assesses, treats (avoid, mitigate, transfer, accept), and monitors risk. Compliance maps controls to frameworks and laws.
Concepts to master
Risk assessment methods (qualitative vs. quantitative; SLE, ARO, ALE = SLE × ARO). Control frameworks (ISO 27001, NIST CSF/RMF) and audit evidence. Third-party/vendor risk, data classification, and privacy obligations. Roles: senior management owns risk appetite; the security team implements. Business impact analysis feeds continuity planning.
Traps
Accepting risk is a management decision, not an IT one. Transferring risk (insurance) doesn't eliminate it. A policy is not a procedure. ALE uses annualized figures-SLE is per-incident. Compliance does not equal security; you can be compliant yet insecure.
Worked example
A laptop loss costs $5,000 per event (SLE) and occurs about twice a year (ARO = 2). ALE = $5,000 × 2 = $10,000/year. If a $3,000 control reduces incidents to 0.5/year, new ALE = $2,500, saving $7,500-justifying the control.
Rule of thumb: quantify with SLE/ARO/ALE, then compare control cost to risk reduction.