This objective covers security governance, the administrative, legal, and structural frameworks that direct and control an organization’s security activities. Governance ensures that technical controls align with business objectives, organizational risk tolerance, and legal mandates.
1. The Governance Hierarchy: Policies, Standards, Guidelines, & Procedures
CompTIA heavily tests the distinctions between these four organizational documents. They flow from high-level abstract mandates down to granular, step-by-step instructions.
Policies (Mandatory, High-Level)➡️ Standards (Mandatory, Specific) ➡️ Procedures (Mandatory, Step-by-Step) ➡️ Guidelines (Optional, Advice)Policies (High-Level Mandates)
Policies are formal, high-level documents established by executive management. They are mandatory and define the organization’s overall security philosophy.
- Acceptable Use Policy (AUP): Defines what actions an employee can and cannot perform using corporate assets (hardware, internet, email). Employees must sign this upon hire to mitigate insider risk.
- Information Security Policies: The overarching blueprint establishing the security program’s core objectives, scope, and enforcement mechanisms.
- Business Continuity (BC) & Disaster Recovery (DR): BC ensures the business can maintain operations during a crisis; DR details how to restore technical infrastructure after a disaster.
- Incident Response (IR): The structural framework detailing how the organization defines, handles, and communicates during a security breach.
- Software Development Lifecycle (SDLC): Integrates security checks (like threat modeling and code analysis) into every phase of software development.
- Change Management: A critical control ensuring that modifications to production environments are formally requested, reviewed for security impact, approved, tested, and documented to prevent accidental self-inflicted outages.
Standards (Mandatory Baselines)
Standards are specific, mandatory requirements or baseline configurations that support a policy.
- Examples: A Password Standard mandating a minimum length of 14 characters; an Encryption Standard requiring Advanced Encryption Standard (AES)-256 for all data at rest; or explicit physical security and access control rules.
Procedures (Step-by-Step Instructions)
Procedures are mandatory, detailed, step-by-step instructions explaining exactly how to implement policies and standards.
- Onboarding/Offboarding Procedures: The exact operational checklist that IT personnel must follow when a user enters or leaves the organization (e.g., identity proofing, account creation, account deletion, and laptop asset retrieval).
- Playbooks: Highly specific, step-by-step tactical incident-response guides designed for technical teams to counter specific attack scenarios (e.g., a Ransomware Playbook or a Phishing Playbook).
Guidelines (Optional Advice)
Guidelines are non-mandatory, flexible recommendations or best practices that provide auxiliary guidance to users when a strict standard doesn’t apply.
2. External Governance Considerations
Internal policy must constantly adapt to external legal, geographical, and industrial realities.
- Regulatory & Legal: Government-enforced laws that mandate strict security frameworks. Failure to comply results in heavy criminal or financial penalties.
- Examples: HIPAA (healthcare data), GLBA (financial institutions), or COPPA (children’s online privacy).
- Industry Standards: Non-governmental compliance frameworks driven by sector requirements.
- Example: PCI DSS (Payment Card Industry Data Security Standard), which any business that processes credit cards must comply with to maintain transaction capabilities.
- Geographic Variations (Local to Global): Security governance must account for data sovereignty laws that change across borders.
- Example: A global enterprise must comply with national laws in the US while adjusting its infrastructure to satisfy the strict data privacy restrictions of European global frameworks like the General Data Protection Regulation (GDPR).
3. Governance Structures, Monitoring, & Revision
- Types of Governance Structures:
- Boards & Committees: Executive leadership bodies (such as the Board of Directors or an internal Risk Committee) that oversee the corporate security posture, allocate funding, and ensure that security risks are managed alongside business risks.
- Government Entities: External regulatory agencies (like the SEC or FTC) that audit corporate disclosures and enforce compliance standards.
- Centralized vs. Decentralized Structures: Centralized governance enforces a singular, uniform set of policies across the entire global organization from a single headquarters. Decentralized governance allows individual business units or geographic branches to tailor their own distinct security policies to fit local operational needs.
- Monitoring and Revision: Security governance is a living lifecycle. Frameworks must undergo regular, scheduled monitoring and revision via audits and post-incident reviews to ensure policies stay aligned with evolving threat landscapes, technical upgrades, and new legal mandates.
4. Roles and Responsibilities for Systems and Data
To ensure proper data protection and privacy compliance, organizations must assign distinct data governance roles to personnel:
- Data Owner: The executive or senior manager ultimately responsible for a specific business data set. The owner dictates the data’s classification tier, defines who has a business “need-to-know” access requirement, and accepts the financial and legal risks associated with that data.
- Data Controller: The entity (typically the corporate organization itself) that determines the purposes and legal means of processing customer or employee personal data.
- Data Processor: A third-party vendor or outsourced service provider that processes personal data exclusively on behalf of and under the direct instruction of the Data Controller (e.g., a third-party payroll processor or a cloud storage provider).
- Data Custodian / Steward: The technical IT or security professional responsible for implementing the actual hands-on security controls dictated by the Data Owner. Custodians handle the daily operational tasks of backing up data, configuring access control lists (ACLs), ensuring data encryption is functional, and maintaining database integrity.