Chapter 1 of 4 · CompTIA SecurityX CAS-005
Governance, Risk, and Compliance
Governance, data rules, risk analysis, vendor risk, compliance, threat models and AI.
- 7topics
- 34 minfast track
- 2diagrams and exhibits
- 20%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Governance, Policies and Change ControlLearn how governance turns goals into policies, standards, procedures and guidelines, and how change and configuration management…5 min
- 2Data Governance and ClassificationCover data owners, classification labels, the data life cycle, retention, sanitization and how to treat production data in…5 min
- 3Risk Analysis and TreatmentPractise qualitative and quantitative risk analysis, SLE, ARO and ALE formulas, risk appetite, inherent and residual risk, and…4 min
- 4Business Impact and Third Party RiskUse business impact analysis with MTD, RTO, RPO, MTBF and MTTR, and manage vendor and supply chain risk with due diligence…Diagram6 min
- 5Compliance and RegulationsSee how laws, standards and contracts shape security strategy, including GDPR, HIPAA, PCI DSS, SOX, data sovereignty, audits…5 min
- 6Threat Modeling MethodsChoose and apply threat modeling methods such as STRIDE, DREAD, attack trees, PASTA, MITRE ATT&CK, CAPEC, the Cyber Kill Chain…4 min
- 7AI Security ChallengesUnderstand AI risks including prompt injection, data poisoning, model theft, data leakage, hallucination and shadow AI, plus…Diagram5 min
About this chapter
What this chapter covers
This chapter is about the decisions that sit above the technology: who sets the rules, how risk is measured and treated, and which laws apply. It also covers threat modeling and the new security challenges that come with artificial intelligence (AI).
It follows Domain 1 of the CompTIA SecurityX CAS-005 outline. The domain has five syllabus topics, and they are covered by seven pages here because governance, risk and compliance each need more than one.
How the topics fit together
Governance sets direction, risk analysis picks priorities, and compliance adds outside requirements. Threat modeling and AI risk feed the same risk process with new information.
- Governance defines policies, standards, procedures, change control and data handling.
- Risk measures likelihood and impact, then chooses mitigate, transfer, avoid or accept.
- Third parties and business impact turn risk into recovery targets and vendor controls.
- Compliance adds mandatory requirements, such as privacy law and industry standards.
- Threat modeling and AI identify how systems can be attacked, including new AI specific attacks.
Scenario questions in this domain usually have a business reason in the stem. Choose the answer that serves that reason, not the most technical control.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with diagrams and tables.
- What to remember for the exam: the facts to memorize.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
This domain has little configuration, so learn the vocabulary exactly. Practise the risk formulas by hand and be ready to tell similar terms apart, such as policy and standard, recovery time and recovery point objectives, or transfer and mitigate.
Ready for more practice?
The full CompTIA SecurityX CAS-005 question bank has 654 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.