Chapter 5 of 5 · CompTIA Security+ SY0-701
Security Program Management and Oversight
Governance, risk, vendors, compliance, audits and awareness.
- 7topics
- 28 minfast track
- 20%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Governance, Policies and RolesSecurity+ governance: policies, standards, procedures and guidelines, common policy types, governance structures, and data owner…4 min
- 2Risk Assessment and AnalysisSecurity+ risk assessment: qualitative and quantitative analysis, SLE, ALE and ARO formulas with worked examples, risk registers…4 min
- 3Risk Strategies and Business Impact AnalysisSecurity+ risk responses of mitigate, transfer, accept and avoid, risk reporting, and business impact analysis with RTO, RPO…4 min
- 4Third-Party Risk ManagementSecurity+ third party risk: vendor due diligence, right to audit, independent assessments, SLA, MSA, SOW, MOU, MOA, NDA and BPA…4 min
- 5Compliance and PrivacySecurity+ compliance and privacy: reporting, penalties for non compliance, due care, attestation, GDPR, HIPAA, PCI DSS, data…4 min
- 6Audits, Assessments and Penetration TestingSecurity+ audits and assessments: attestation, internal and external reviews, penetration test types, known and unknown…4 min
- 7Security Awareness ProgramsSecurity+ security awareness: phishing campaigns, reporting, anomalous behavior, insider threats, password and USB guidance…4 min
About this chapter
What this chapter covers
This chapter is about governance, risk and compliance (GRC): how an organization decides what to protect, how much risk to accept and how to prove that it is doing the right things.
It has six outline topics, and they are spread across seven pages. The material is less technical than other chapters, but it is full of defined terms, formulas and document types that exams like to test.
How the topics fit together
The chapter follows the life of a security program from rules to proof.
- Governance sets policies, standards, procedures and the roles of data owners and custodians.
- Risk management identifies, measures and treats risk, including the formulas for expected loss.
- Third party risk applies the same thinking to vendors and suppliers.
- Compliance and audits show that the rules are followed, with internal checks, external audits and penetration tests.
- Awareness prepares staff to follow the rules and spot attacks.
Learn the vocabulary exactly. Many questions differ by a single term, such as policy versus standard, or exception versus exemption.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with diagrams and tables.
- What to remember for the exam: the facts to memorise.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Work through the risk formulas by hand a few times, since calculation questions are common and easy to get right with practice.
Ready for more practice?
The full CompTIA Security+ SY0-701 question bank has 848 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.