Security+ level · Domain 5.0 Security Program Management and Oversight · 20% of the mapped exam

5.1 Summarize elements of effective security governance.

30 topics · 4 quiz questions

Governance is how an organisation directs and controls security: documents that set expectations, structures that make decisions, and roles that own data.

Guidelines and policies

Guidelines: Recommended, non-mandatory advice.
Acceptable use policy (AUP): What users may and may not do with company systems.
Information security policies: High-level statements of management's security intent and requirements.
Business continuity: Policy for keeping essential functions running during disruption.
Disaster recovery: Policy for restoring IT systems after a disaster.
Incident response: Policy defining how incidents are handled, reported and escalated.
Software development lifecycle (SDLC): Policy requiring security at each stage of building software.
Change management (policy): Policy requiring changes to be requested, reviewed, approved and documented.

Standards

Password: Specific requirements such as minimum length and MFA.
Access control: How access is requested, approved, reviewed and removed.
Physical security: Requirements for facilities, badges, visitors.
Encryption: Approved algorithms, key lengths and where encryption is required.

Procedures

Change management (procedure): Step-by-step process for making changes.
Onboarding/offboarding: Steps for granting access when people join and removing it when they leave.
Playbooks: Step-by-step response guides for specific scenarios, such as a phishing report.

External considerations

Regulatory: Rules from regulators that must be followed.
Legal: Laws and contractual obligations.
Industry: Sector standards such as PCI DSS.
Local/regional: State or regional laws.
National: Country-level laws.
Global: Laws with international reach, such as GDPR.

Monitoring, revision and structures

Monitoring and revision: Policies are reviewed regularly and updated when laws, technology or the business change.
Boards: Senior oversight bodies ultimately accountable for risk.
Committees: Groups that oversee specific areas, such as a security steering committee.
Government entities: Public bodies with their own governance and oversight requirements.
Centralized/decentralized: Centralised governance sets one standard for all; decentralised lets units decide, which is faster but less consistent.

Roles and responsibilities for systems and data

Owners: Senior people accountable for data; decide classification and who gets access.
Controllers: Decide why and how personal data is processed (a privacy-law term).
Processors: Process personal data on behalf of a controller.
Custodians/stewards: Look after data day to day: backups, access implementation, quality.

Check your understanding

< 4.9 previous 5.2 next >

Original CoreQ Academy material, mapped to objective 5.1 of the publicly available CompTIA Security+ SY0-701 exam objectives (Exam objectives V7, document version 7.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.