Governance

• Governance is leadership setting direction in writing
• Policies, standards, and procedures are mandatory; only guidelines are discretionary
• A policy is high-level intent, broad and rarely changing
• A standard names the exact required setting
• A procedure is the ordered step-by-step how-to
• A guideline is recommended practice, not a requirement
• Identify the document type by how general or specific it is
• The hierarchy runs policy then standard then procedure, with guidelines advising
• Regulations and laws are external and mandatory, written by governments
• HIPAA and GDPR are laws a CC candidate should recognize by name
• PCI DSS is a contractual industry standard, not a government law
• Accountability cannot be delegated, only the work can
• Governance is about documents, not about choosing individual controls
• Classify a mixed document or system at the highest sensitivity level present
• The data owner sets classification and access; the custodian implements the controls
• Higher classification levels demand stronger controls, so classify to prioritize protection
• GDPR gives data subjects rights like erasure and requires 72-hour breach notice
• Review security policies at least annually and when significant changes occur

Unlock with Premium — includes all practice exams and the complete study guide.