Exam objective

SY0-701 5.1: Security Governance

Security+ Topic

Security Governance for Security+

This Security+ topic covers governance document hierarchy and examples: guidelines, policies, standards, and procedures; Named policy examples: acceptable use policy (AUP), information security policies, business continuity, disaster recovery, incident response, software development lifecycle (SDLC), and change management; Named standard examples: password, access control, physical security, and encryption standards; Named procedure examples: change management, onboarding, offboarding, and playbooks.

Start first lesson

4 lessons in this topic

1

Governance Documents

Differentiate guidelines, policies, standards, and procedures, including AUP, information security, continuity, recovery, incident response, SDLC, change, password, access, physical, and encryption examples.

2

External Governance Considerations

Recognize regulatory, legal, industry, local, regional, national, and global influences on governance.

3

Governance Structures

Compare boards, committees, government entities, and centralized or decentralized governance models.

4

Data And System Roles

Differentiate owners, controllers, processors, custodians, and stewards for systems and data responsibility.

Common mistakes to avoid

1

Learners often mix up policy, standard, and procedure. The shortest correction is: policy says what must be true, standard says the required measurable baseline, and procedure says how to do the work.

2

Learners often treat regulatory and legal as identical. The correction: regulatory usually points to a regulator or formal regulation; legal is broader and includes contracts, lawsuits, court orders, liability, and counsel-driven obligations.

3

Learners often equate centralized with more secure and decentralized with less secure. The correction: both are governance models with tradeoffs. Centralized improves consistency; decentralized improves local responsiveness.

4

Learners often assume the administrator is the owner because the administrator has technical access. The correction: the owner is accountable for business and risk decisions; the custodian administers or safeguards the asset.