5.1 Summarize elements of effective security governance

Domain 5: Security Program Management and Oversight

Governance is the framework of documents, structures, and roles that direct a security program. Keep the document hierarchy straight: policies state management intent (acceptable use, information security, business continuity, incident response, SDLC, change management), standards make them measurable (password, access control, encryption, physical security), procedures give step-by-step instructions (onboarding, offboarding, playbooks), and guidelines are optional recommendations. Know the external considerations — regulatory, legal, industry, and jurisdictional influences at local through global levels — and governance structures like boards, committees, and centralized versus decentralized models. Roles and responsibilities for data are tested heavily: owners set requirements and accept risk, controllers determine purposes of processing, processors act on a controller's behalf, and custodians or stewards handle day-to-day management. The classic trap is confusing policy with procedure, or owner with custodian — remember that ownership and accountability stay with management even when technical work is delegated. Also expect questions on why governance must be revised as regulations and business needs change.

common pitfall · Candidates confuse the document hierarchy and the data roles, assigning accountability to custodians or processors when it always remains with owners and controllers.