Domain 1 of 5 · Chapter 3 of 5

Understand Governance Concepts

Unlock the complete study guide + 12 practice exams totaling 1,500 questions.

Bundled into the existing Certified in Cybersecurity premium course — no separate purchase.

14-day money-back guarantee — no questions asked.

Included in this chapter:

  • Where security direction comes from
  • Laws and regulations
  • Frameworks and published standards
  • NIST CSF 2.0: Functions, Profiles and Tiers
  • Internal governance documents: the four types
  • Program, issue-specific and system-specific policy
  • How governance documents stay authoritative

Internal governance documents: policy vs standard vs procedure vs guideline

QuestionPolicyStandardProcedureGuideline
What it statesManagement's direction, scope and responsibilitiesA specific technology, parameter or method to use uniformlyThe detailed steps to complete one taskA recommended practice
How bindingMandatory; it gives the program its authorityNormally compulsory within its scopeFollowed by the people who perform the taskDiscretionary unless another authority requires it
Level of detailBroad and high levelSpecificMost detailedFlexible; can be met more than one way
ExampleA program policy creating the security programUniform identification badges across the organizationPreparing a new user account and assigning its privilegesAdvice that helps teams write system-specific procedures

Decision tree

A law or regulationfrom a government?Laws and regulationsrequired by governmentYesNoOutside guidance, not law,adopted or required?Frameworks and published standardschosen or requiredYesNoInternal governance documentsSets direction andresponsibility?Policymanagement directionYesNoGives the exact stepsfor one task?Procedurestep-by-step tasksYesNoMandatory withinits scope?Standardmandatory specificsYesNoGuidelinerecommended practice
Cheat sheet

Cheat sheet

  • Organizational policy must operate within applicable law
  • The HIPAA Security Rule protects electronic PHI in regulated entities
  • GDPR is a legal framework for protecting personal data
  • FISMA establishes federal information-security responsibilities
  • Sarbanes-Oxley addresses accountability in corporate financial reporting
  • A security policy establishes management direction and expectations
  • Organizational standards specify mandatory, consistent requirements
  • Procedures describe the steps for performing a task
  • Guidelines recommend practices while allowing implementation flexibility
  • Issue-specific policies address particular technologies or activities
  • NIST CSF organizes desired cybersecurity outcomes without prescribing products
  • The CSF Govern function establishes and oversees cybersecurity direction
  • ISO/IEC 27001 specifies requirements for an information security management system
  • CIS Controls provide a prioritized set of practical safeguards
  • CIS Benchmarks recommend secure configurations for specific technologies
  • CSF Profiles distinguish current outcomes from desired outcomes
  • Governance defines how security decisions are made and overseen
  • Policy exceptions require the approval route established by governance
  • Policies must remain current and available to the people implementing them
  • AI tools remain subject to ordinary organizational and legal requirements

Unlock with Premium — includes all practice exams and the complete study guide.

Also tested in

References

  1. https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html
  2. https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
  3. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-12r1.pdf
  4. https://gdpr.eu/what-is-gdpr/
  5. https://www.iso.org/standard/27001
  6. https://www.cisa.gov/topics/cyber-threats-and-advisories/federal-information-security-modernization-act
  7. https://www.cisecurity.org/controls
  8. https://www.cisecurity.org/cis-benchmarks
  9. https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf