Security+ topic 5.1
Security Governance
Governance is how an organization sets direction and holds people accountable for security. Policies state high-level rules, such as an acceptable use policy. Standards set specific required settings, such as password length, and procedures give step-by-step instructions, such as onboarding or incident response playbooks. Guidelines are recommendations. Governance can be run by boards and committees, and roles matter: the data owner is accountable for data, the data controller decides how it is used, the data processor handles it for the controller, and the data custodian manages it day to day.
Security Governance vocabulary
- Acceptable use policy (AUP): Rules for how employees may use the organization's systems and network.
- Standard: A specific, required rule or setting that supports a policy.
- Data owner: The senior person accountable for a set of data and how it is classified.
- Data custodian: The person or team that manages and protects data day to day.
Exam-style practice questions
Try each one, then open the answer. To save your progress, take this quiz in the interactive course.
1. A document says passwords must be at least 14 characters and changed after any suspected compromise. Which of the following is this?
- (A) A guideline
- (B) A standard
- (C) A procedure
- (D) An SLA
Show answer
(B) A standard A specific, required setting is a standard.
2. New employees must sign a document that explains what they may and may not do on company computers. Which of the following is this?
- (A) Acceptable use policy
- (B) Non-disclosure agreement
- (C) Service-level agreement
- (D) Rules of engagement
Show answer
(A) Acceptable use policy The AUP sets rules for using company systems.
3. A vice president is accountable for customer data and decides how it is classified. Which role does the vice president hold?
- (A) Data owner
- (B) Data custodian
- (C) Data processor
- (D) Data subject
Show answer
(A) Data owner The data owner is accountable for the data and its classification.
4. The IT team backs up, patches and manages the database that holds customer records. Which role does the IT team hold?
- (A) Data controller
- (B) Data custodian
- (C) Data owner
- (D) Data subject
Show answer
(B) Data custodian The custodian manages and protects data day to day.