Governance, Risk, and Compliance · Topic 1 of 7
Governance, Policies and Change Control
Learn how governance turns goals into policies, standards, procedures and guidelines, and how change and configuration management keep them enforced.
- 5 min
- Policy says what and why, standards say how well, procedures say how to do it, and guidelines are optional advice.
- Policies, standards and procedures are mandatory. Only guidelines are advisory.
- Senior management approves policy, because accountability for risk sits with leadership.
What it is
Security governance is the system of decisions, roles and rules that makes sure security supports the business. It answers who is accountable, what the rules are and how anyone checks that the rules are followed.
At the SecurityX level you are expected to choose the right governance component for a situation. That means knowing which document type fits a need, which framework suits an organization, and how change control protects the rules you set.
How it works
Governance is layered. Each layer is more specific than the one above it, and each has a different level of flexibility.
The document hierarchy
| Document | Purpose | Mandatory? | Example |
|---|---|---|---|
| Policy | High level statement of intent, approved by senior management | Yes | All laptops must be encrypted |
| Standard | Specific, measurable requirement that supports a policy | Yes | Use full disk encryption with a minimum 256 bit key |
| Procedure | Ordered steps to perform a task | Yes | How to enrol a laptop in disk encryption |
| Guideline | Advice and good practice where judgment is allowed | No | Suggested ways to pick a strong passphrase |
A baseline is a minimum configuration that systems must meet, so it usually sits next to the standards. Policies change rarely, while procedures change whenever tools or staff change.
Frameworks and who sets direction
A framework gives a ready made structure so you do not invent controls from nothing. Common examples are the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), the International Organization for Standardization and International Electrotechnical Commission (ISO/IEC) 27001 standard for an information security management system (ISMS), and Control Objectives for Information and Related Technologies (COBIT) for IT governance.
Choose a framework by what the organization needs. A certifiable management system points to ISO/IEC 27001, while a flexible outcome model for communicating risk to executives points to NIST CSF.
Governance bodies such as a board risk committee or a security steering group approve policy and accept risk. Staff roles such as data owner and data custodian are covered on the next page.
Governance, risk and compliance tools
A governance, risk and compliance (GRC) tool stores policies, maps controls to several frameworks, tracks risks and collects audit evidence. Its value is a single source of truth, so one control test can satisfy many requirements. It does not replace judgment about whether a control is effective.
Change and configuration management
Change management is the controlled process for altering systems. A typical request is assessed for risk, approved by a change advisory board (CAB), scheduled, tested, and given a rollback plan.
Configuration management records the approved state of each system. A configuration management database (CMDB) holds configuration items and their relationships, so you can see what a change will touch.
Emergency changes still need approval and documentation, often after the fact. Drift detection compares the running state with the approved baseline and flags unapproved differences.
Exceptions and accountability
No policy fits every system. A formal exception process records the reason, the compensating control, the owner and an expiry date. An exception without an expiry quietly becomes permanent policy.
Governance also needs measurement. Metrics such as patch compliance, policy exception counts and audit findings show whether the rules work, and they feed reports to management.
Security program management
Rules only work if people know them and leaders back them. Awareness training should be role based and repeated, and cover phishing, social engineering, privacy duties, operational security (not leaking plans or details through casual channels) and situational awareness (noticing and reporting odd activity).
Staff need clear reporting lines for incidents and concerns, and leaders need regular reports in business terms. Management commitment means visible sponsorship: funding, approving policy and following the rules themselves. Without it, policies are ignored.
A responsible, accountable, consulted and informed (RACI) matrix assigns each task to roles. Responsible does the work, accountable owns the outcome and approves it (only one per task), consulted gives input before, and informed is told afterwards.
| Task | IT operations | Security team | System owner | Management |
|---|---|---|---|---|
| Test and deploy a critical patch | R | C | A | I |
| Contain a compromised host | R | A | C | I |
What to remember for the exam
- Policy says what and why, standards say how well, procedures say how to do it, and guidelines are optional advice.
- Policies, standards and procedures are mandatory. Only guidelines are advisory.
- Senior management approves policy, because accountability for risk sits with leadership.
- Pick ISO/IEC 27001 when certification of a management system is the goal, and NIST CSF for a flexible, outcome based approach.
- A GRC tool maps one control to many requirements and gathers evidence.
- Change management needs risk assessment, approval, testing and a rollback plan.
- A CMDB shows relationships between configuration items, which helps impact analysis.
- Exceptions need an owner, a compensating control and an expiry date.
When two answers both sound like governance, ask which one is mandatory and measurable. That points to a standard, while a flexible suggestion points to a guideline.
Common mistakes
Mixing up standards and procedures. A standard states a required outcome or setting. A procedure lists the steps that achieve it.
Treating guidelines as rules. Auditors cannot fail someone for ignoring advice, so a control that must be enforced belongs in policy or a standard.
Skipping change control for urgent fixes. Emergency changes need a faster path, not no path, and the record is still required.
Believing a framework equals compliance. Adopting NIST CSF or ISO/IEC 27001 structure does not by itself satisfy a law or contract, which may demand specific controls.
Letting exceptions live forever. An exception with no review date hides risk that leadership never agreed to carry.
A change that passes testing in staging can still fail in production, so a rollback plan is not optional.
Check yourself
Work through these three questions.
Which document type is advisory rather than mandatory?
A guideline. Policies, standards and procedures are all mandatory.
Why does a change advisory board matter?
It reviews the risk and impact of a change before approval, which reduces outages and unplanned security gaps.
What should a policy exception always include?
A reason, a compensating control, an owner and an expiry or review date.
Topic 1 of 7 in Governance, Risk, and Compliance
Test yourself on Governance, Risk, and Compliance
The full CompTIA SecurityX CAS-005 question bank has 654 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.