Security Program Management and Oversight for Security+

Security Governance

This Security+ topic covers governance document hierarchy and examples: guidelines, policies, standards, and procedures; Named policy examples: acceptable use policy (AUP), information security policies, business continuity, disaster recovery, incide...

Risk Management

This Security+ topic covers risk identification and risk assessment cadence: ad hoc, recurring, one-time, and continuous; Risk analysis concepts: qualitative, quantitative, SLE, ALE, ARO, probability, likelihood, exposure factor, and impact; Risk tra...

Third-Party Risk Management

This Security+ topic covers vendor assessment evidence: penetration testing evidence, right-to-audit clauses, evidence of internal audits, independent assessments, and supply chain analysis; Vendor selection: due diligence and conflict of interest; A...

Security Compliance

This Security+ topic covers compliance reporting: internal and external; Consequences of non-compliance: fines, sanctions, reputational damage, loss of license, and contractual impacts; Compliance monitoring: due diligence, due care, attestation, ack...

Audits and Assessments

This Security+ topic covers attestation as a formal assertion or assurance output connected to assessment results; Internal assessment contexts: compliance, audit committee, and self-assessments; External assessment contexts: regulatory, examinations...

Security Awareness Practices

This Security+ topic covers phishing practices: campaigns, recognizing a phishing attempt, and responding to reported suspicious messages; Anomalous behavior recognition: risky, unexpected, and unintentional behavior; User guidance and training: poli...