Domain 520% of scored content
Security Program Management and Oversight
The governance side of security: policies and roles, managing risk, vetting third parties, meeting compliance duties, running audits and assessments, and building security awareness.
6 topics
About 12 minutes of reading
- 5.1Security governanceGovernance sets direction and accountability. It covers guidelines, policies, standards, and procedures; external considerations such as regulations; monitoring and revision; governance structures; and the roles of owners, controllers, processors, and custodians.2 min read
- 5.2Risk managementRisk management identifies risks, assesses them qualitatively or quantitatively, records them in a register, and treats them by transfer, acceptance, avoidance, or mitigation. Business impact analysis adds recovery targets such as RTO and RPO.2 min read
- 5.3Third-party risk managementVendors extend your attack surface. This objective covers vendor assessment, selection, agreements, monitoring, questionnaires, and rules of engagement.2 min read
- 5.4Security complianceCompliance means meeting the laws, regulations, and contracts that apply. This objective covers internal and external reporting, consequences of non-compliance, monitoring, attestation, automation, and privacy concepts such as data subject rights and the right to be forgotten.2 min read
- 5.5Audits and assessmentsAudits and assessments verify that controls work. This objective covers attestation, internal audits and self-assessments, external audits and regulatory examinations, and penetration testing approaches: physical, offensive, defensive, integrated, known, partially known, unknown environments, and reconnaissance.2 min read
- 5.6Security awarenessPeople are both the most targeted part of an organization and a strong defense when trained. This objective covers phishing campaigns, recognizing anomalous behavior, user guidance and training, reporting and monitoring, and developing and executing an awareness program.2 min read