CoreQ Academy1.1 Given a set of organizational security requirements, implement the appropriate governance components.
At the architect level, governance is how you turn requirements into an operating program: documents, frameworks, roles, change control and tools that keep it all traceable.
Security program documentation
- Policies
- Mandatory high-level statements of intent approved by leadership.
- Procedures
- Step-by-step instructions to carry out a policy.
- Standards
- Specific mandatory requirements (e.g. TLS 1.2+ only, AES-256).
- Guidelines
- Recommended practices that allow judgment.
Security program management
- Awareness and training
- Role-appropriate education that changes behaviour.
- Phishing
- Simulations and reporting training.
- Security
- General security hygiene training.
- Social engineering
- Recognising pretexting, impersonation and pressure tactics.
- Privacy
- Handling personal data correctly.
- Operational security
- Not leaking sensitive details through everyday behaviour.
- Situational awareness
- Noticing anomalies in the physical and digital environment.
- Communication
- Regular, clear program updates to stakeholders.
- Reporting
- Metrics and status reporting to leadership and the board.
- Management commitment
- Visible executive sponsorship and funding; without it programs fail.
- Responsible, accountable, consulted, and informed (RACI) matrix
- A chart assigning who does the work, who owns the outcome, who is consulted and who is informed for each activity.
Governance frameworks
- Control Objectives for Information and Related Technologies (COBIT)
- ISACA framework for governance and management of enterprise IT, aligning IT with business goals.
- Information Technology Infrastructure Library (ITIL)
- Best-practice framework for IT service management (incident, change, problem, service levels).
Change/configuration management
- Asset management life cycle
- Tracking assets from procurement through disposal.
- Configuration management database (CMDB)
- Repository of configuration items and their relationships, used for impact analysis and incident response.
- Inventory
- Accurate list of hardware, software, cloud and data assets.
Governance risk and compliance (GRC) tools
- Mapping
- Linking controls to multiple frameworks so one control satisfies many requirements.
- Automation
- Automatic evidence collection and control testing.
- Compliance tracking
- Dashboards of control status against requirements.
- Documentation
- Central storage of policies, evidence and approvals.
- Continuous monitoring
- Ongoing automated checks instead of point-in-time audits.
Data governance in staging environments
- Production
- Live data and systems with the strictest controls.
- Development
- Should not contain real sensitive data; use synthetic or masked data.
- Testing
- Test environments need controlled, sanitised data sets.
- Quality assurance (QA)
- Pre-production validation environment; mirrors production configuration without exposing real data.
- Data life cycle management
- Governing data from creation through storage, use, sharing, archiving and destruction.
Check your understanding
Loading quiz…
Original CoreQ Academy material, mapped to objective 1.1 of the publicly available CompTIA SecurityX CAS-005 exam objectives (Exam objectives V5, document version 7.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.