Chapter 5 of 5 · CompTIA Security+ SY0-801
Security Program Management and Oversight
GRC artifacts, risk, vendors, compliance, audits and awareness.
- 7topics
- 33 minfast track
- 14%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Governance Policies, Standards and ProceduresSecurity+ GRC artifacts: guidelines, standards, procedures, runbooks, continuity plans and the ten policy types, from AUP and…5 min
- 2Risk Assessment and AnalysisSecurity+ risk identification, scoring and categorization, impact and likelihood, qualitative vs quantitative analysis, risk…4 min
- 3Risk Treatment and Business ImpactSecurity+ risk treatment: transfer, accept, avoid and mitigate, plus BIA, risk appetite, residual risk and the SLE, ARO and ALE…5 min
- 4Third-Party Risk ManagementSecurity+ third-party risk: RFP, RFI, RFQ, due diligence, SLA, SLO, MSA, SOW, MOU, MOA and NDA, vendor monitoring, constraints…5 min
- 5Compliance and PrivacySecurity+ compliance: AML/CTF and anti-bribery training, attestations, non-compliance penalties, privacy rights, controller vs…5 min
- 6Audits, Assessments and Penetration TestingSecurity+ audits: sampling, assertions, ATT&CK and Kill Chain, audit charter, internal and external reviews, benchmarking and…5 min
- 7Security Awareness ProgramsSecurity+ awareness training: onboarding, ongoing, targeted and corrective training, LMS delivery, behavior risk scoring, BEC…4 min
About this chapter
What this chapter covers
This chapter is about governance, risk and compliance (GRC): how an organization decides what to protect, how much risk to accept and how to prove that it is doing the right things. It is 14% of the CompTIA Security+ SY0-801 exam.
It has six exam objectives, spread across seven pages. The material is less technical than other chapters, but it is full of defined terms, formulas and document types that the exam likes to test.
How the topics fit together
The chapter follows the life of a security program from rules to proof.
- Governance sets policies, standards, procedures, guidelines and plans.
- Risk management identifies, scores and treats risk, including the formulas for expected loss.
- Third-party risk applies the same thinking to choosing, contracting and monitoring vendors.
- Compliance and audits show that the rules are followed, through training, attestations, privacy duties, audits and penetration tests.
- Awareness prepares staff to follow the rules and spot attacks, and measures whether it works.
Learn the vocabulary exactly. Many questions differ by a single term, such as policy versus standard, SLA versus SLO, or opt-in versus opt-out.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with diagrams and tables.
- What to remember for the exam: the facts to memorize.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Work through the risk formulas by hand a few times, since calculation questions are common and easy to get right with practice.
Ready for more practice?
The full CompTIA Security+ SY0-801 question bank has 998 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.