Security Principles · Topic 3 of 4
Governance and Security Controls
Laws and regulations, frameworks, policies, standards and procedures, and technical, administrative and physical security controls for the ISC2 CC exam.
- 3 min
- Includes a diagram
- Laws are mandatory; frameworks guide.
- Policy states intent; standards set specific requirements; procedures give steps; guidelines are optional.
- Technical, administrative and physical are the three control categories.
What it is
Governance is how an organization sets direction for security: following laws, choosing frameworks and writing the documents everyone must follow. Security controls are the safeguards that put that direction into practice. CC asks you to tell the document types apart and to classify controls.
How it works
Laws, regulations and frameworks
- Laws and regulations are mandatory and set by governments, for example privacy laws such as the EU GDPR or health data rules such as HIPAA in the US.
- Industry standards and frameworks guide how to build a security program, for example ISO/IEC 27001, the NIST Cybersecurity Framework, the CIS Controls and PCI DSS for card payments.
Passing a compliance assessment shows a minimum is met. Compliance is a floor, not full security: a company can pass an assessment and still be breached.
The document hierarchy
| Document | Nature | Example |
|---|---|---|
| Policy | High-level management intent; mandatory | "Sensitive data must be encrypted" |
| Standard | Specific mandatory requirement | "Use AES-256 for stored data" |
| Procedure | Step-by-step instructions | How to encrypt a laptop |
| Guideline | Recommended, not mandatory | Tips for strong passphrases |
| Baseline | Minimum security configuration | Hardened server build |
Policies are approved by senior leadership. An acceptable use policy tells staff what they may do with systems, including which AI tools they may use and what data they may enter into them.
Control categories
| Category | Meaning | Examples |
|---|---|---|
| Technical (logical) | Enforced by technology | Firewalls, encryption, MFA, antivirus |
| Administrative (managerial) | Rules and processes set by management | Policies, training, background checks, approval requirements |
| Physical | Protect facilities and hardware | Locks, fences, guards, badge readers, cameras |
A rule that requires manager approval before staff use an external AI tool is an administrative control, even if a system later enforces it.
Control functions
Controls also differ by what they do: preventive (stop an incident, such as a lock), detective (find one, such as a camera or log review), corrective (fix after, such as restoring from backup), deterrent (discourage, such as a warning sign) and compensating (an alternative when the main control is not possible). A control has one category and one or more functions.
Defense in depth
Several different controls together protect better than one. An AI email filter plus staff trained to report suspicious messages is an example: if one fails, the other may still catch the attack.
How the exam asks about this
- "Which document gives step-by-step instructions?" A procedure.
- "A fence around a data center is what type of control?" Physical.
- "A company passes PCI DSS and is then breached. What does this show?" Compliance is a minimum, not complete security.
What to remember for the exam
- Laws are mandatory; frameworks guide.
- Policy states intent; standards set specific requirements; procedures give steps; guidelines are optional.
- Technical, administrative and physical are the three control categories.
- Preventive, detective, corrective, deterrent and compensating are control functions.
- Compliance is the minimum, not the goal.
Detective is a function, not a category. If a question asks for the category of a policy, the answer is administrative.
Common mistakes
Calling a guideline mandatory.
Mixing categories with functions.
Treating compliance as proof of security.
Check yourself
Which document states management's high-level intent?
A policy.
What category of control is security awareness training?
Administrative.
Name one physical control.
A lock, fence, guard, badge reader or camera.
Topic 3 of 4 in Security Principles
Test yourself on Security Principles
The full ISC2 CC question bank has 671 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.