Security Program Management and Oversight · Topic 1 of 7
Governance, Policies and Roles
Security+ governance: policies, standards, procedures and guidelines, common policy types, governance structures, and data owner, controller and processor.
- 4 min
- Policies set intent, standards set measurable requirements, procedures give steps and guidelines are optional advice.
- An acceptable use policy defines allowed behavior on company systems.
- External factors include law, regulation, industry rules and national or global requirements.
What it is
Security governance is how an organization directs and controls its security program. It sets the rules, assigns responsibility and checks that the rules are followed.
Governance documents form a hierarchy, from broad intent down to step by step instructions. The exam asks you to tell these document types apart and to match people to their data roles.
How it works
The document hierarchy
| Document | Purpose | Mandatory? |
|---|---|---|
| Policy | High level statement of intent and rules, approved by management | Yes |
| Standard | Specific, measurable requirement that supports a policy, such as minimum password length | Yes |
| Procedure | Step by step instructions for a task, such as onboarding a user | Yes, for the task |
| Guideline | Recommended practice and advice | No |
A policy says that data must be protected. A standard says that it must be encrypted with a given strength. A procedure shows how an administrator does it, and a guideline offers tips.
Common policy types
| Policy | Covers |
|---|---|
| Acceptable use policy (AUP) | What users may and may not do with company systems |
| Information security policies | Overall rules for protecting information |
| Business continuity and disaster recovery | How to keep operating and recover after disruption |
| Incident response | How incidents are handled |
| Software development life cycle (SDLC) | Security in how software is built |
| Change management | How changes are requested, approved and recorded |
| Onboarding and offboarding | Granting and removing access when staff join and leave |
Standards of various kinds
Standards in the objective include password, access control, physical security and encryption standards. Each gives measurable settings that make the policy enforceable.
External considerations
Governance must account for outside requirements. These include regulatory and legal rules, industry standards, and local, regional, national and global laws. Frameworks such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework give structure to a program, even where they are not mandatory.
ISO/IEC 27001 sets requirements for an information security management system, and ISO/IEC 27002 gives guidance on security controls. Both come from the International Organization for Standardization and the International Electrotechnical Commission.
Monitoring and revision
Policies must be reviewed regularly and updated after changes in law, technology, business or after an incident. A policy that is never reviewed becomes out of date and unenforceable.
Governance structures
| Structure | Role |
|---|---|
| Boards | Provide top level oversight and accountability |
| Committees | Specialized groups that review and advise, such as a risk committee |
| Government entities | Regulators and agencies that set legal requirements |
| Centralized | One group makes decisions for the whole organization |
| Decentralized | Business units or locations decide for themselves |
Data roles
| Role | Responsibility |
|---|---|
| Data owner | Senior person accountable for a dataset, decides classification and access |
| Data controller | Decides why and how personal data is processed |
| Data processor | Processes personal data on behalf of the controller |
| Data custodian or steward | Handles the day to day care of the data, such as storage and backups |
What to remember for the exam
- Policies set intent, standards set measurable requirements, procedures give steps and guidelines are optional advice.
- An acceptable use policy defines allowed behavior on company systems.
- External factors include law, regulation, industry rules and national or global requirements.
- Policies need regular review and revision.
- Boards and committees provide oversight, and government entities set legal duties.
- The data owner is accountable, and the custodian handles daily protection.
- A controller decides how personal data is used, and a processor acts on the controller's behalf.
- Centralized governance gives consistency, and decentralized governance gives local flexibility.
When a question asks which document tells an administrator exactly how to perform a task, the answer is a procedure.
Common mistakes
Mixing up policy and standard. A policy states the rule in general terms, while a standard gives the specific value or technology.
Treating guidelines as required. They are recommendations only.
Confusing owner and custodian. The owner is accountable and decides. The custodian carries out the care.
Writing a policy and never reviewing it. Old policies drift away from how the business really works.
Mixing up controller and processor. The controller decides the purpose of the processing, and the processor follows instructions.
A policy without enforcement or support from management is just a document. Governance needs authority and follow up.
Check yourself
Which governance document is optional advice?
A guideline.
Who is accountable for a dataset and decides how it is classified?
The data owner.
What is the difference between a data controller and a data processor?
The controller decides why and how personal data is processed, while the processor handles it on the controller's behalf.
Topic 1 of 7 in Security Program Management and Oversight
Test yourself on Security Program Management and Oversight
The full CompTIA Security+ SY0-701 question bank has 848 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.