Skip to content

Menu

ExamPassoLog in

CompTIA Security+: Security Program Management and Oversight Concepts

Importance ★★★☆☆ · 20% (estimate)

Overview

This chapter covers how an organization runs its security program: the documents that guide it, how risk is measured and handled, how vendors are checked, which laws and standards apply, and how audits and training keep the program honest.

Policies state high-level rules, standards set specific requirements, and procedures give step-by-step instructions. An acceptable use policy tells employees how they may use company systems. The data owner decides how data is classified and who may access it, while the custodian carries out the day-to-day care. Under privacy laws such as GDPR, the controller decides why and how personal data is processed and the processor handles it on the controller's behalf. Separation of duties keeps one person from completing a sensitive task alone.

The four risk responses are accept, avoid, transfer (for example, insurance), and mitigate. Inherent risk exists before controls and residual risk remains after them. A risk register lists risks, owners, and responses, and risk appetite describes how much risk the organization is willing to take. In quantitative analysis, SLE = asset value × exposure factor, ARO is the expected yearly frequency, and ALE = SLE × ARO. A business impact analysis identifies critical functions and the cost of disruption.

Vendors are checked with due diligence such as questionnaires and audit reports, and agreements include SLAs for service levels and NDAs for confidentiality. PCI DSS applies to card payments and HIPAA to U.S. health information; non-compliance can bring fines and reputation damage. Penetration tests run under written rules of engagement, and testers may have full information (known environment) or none (unknown environment). External audits give an independent attestation. Security awareness programs use phishing simulations and teach users to report suspicious messages.

Key concepts

  • Risk responses

    Accept, avoid, transfer, mitigate. Insurance is transfer; stopping the activity is avoid.

    Memory tipInsurance = transfer

  • Quantitative risk

    SLE = asset value × exposure factor; ARO = times per year; ALE = SLE × ARO.

    Memory tipALE = SLE × ARO

  • Governance documents

    Policy (what and why), standard (specific requirement), procedure (step-by-step how).

    Memory tipSteps = procedure

  • Data roles

    Owner decides classification and access; custodian carries out daily care; controller decides purpose of processing; processor acts for the controller.

    Memory tipOwner decides

  • Vendor agreements

    SLA sets service levels such as uptime; NDA keeps shared information confidential.

    Memory tipUptime promise = SLA

  • Compliance

    PCI DSS covers payment card data; HIPAA covers U.S. health information.

    Memory tipCard data = PCI DSS

Often tested

  • Residual risk is what remains after controls.
  • Rules of engagement give written permission and scope for a pen test.
  • Report suspicious emails; do not forward or reply.

3 sample questions

Verified practice questions from this unit.

Practice questionReviewedSecurity+ (SY0-701) › Security Program Management and Oversight★★★★☆

Question 1. A company decides to buy cyber insurance to cover losses from a data breach. Which risk response is this?

  1. ① Transfer
  2. ② Mitigate
  3. ③ Avoid
  4. ④ Accept
▼ Show answer and explanation▲ Hide answer and explanation

Answer: ① Transfer

Key point: Insurance = risk transference

Transferring risk moves the financial impact to another party, such as an insurer. The four common responses are accept, avoid, transfer, and mitigate.

Wrong choices

  • Accept: Accepting means taking the risk without further action.
  • Avoid: Avoiding means stopping the risky activity altogether.
  • Mitigate: Mitigating means adding controls to reduce the risk.
Practice questionReviewedSecurity+ (SY0-701) › Security Program Management and Oversight★★★★☆

Question 2. A company stops offering a risky online service completely because the risk is too high. Which risk response is this?

  1. ① Mitigate
  2. ② Avoid
  3. ③ Transfer
  4. ④ Accept
▼ Show answer and explanation▲ Hide answer and explanation

Answer: ② Avoid

Key point: Stop the activity = avoid

Avoiding risk means not doing the activity that creates it.

Wrong choices

  • Transfer: Transfer shifts the impact to another party, such as an insurer.
  • Accept: Accepting keeps the activity and the risk.
  • Mitigate: Mitigating keeps the activity but adds controls.
Practice questionReviewedSecurity+ (SY0-701) › Security Program Management and Oversight★★★★☆

Question 3. Which document sets out the rules for how employees may use company computers, email, and internet access?

  1. ① Non-disclosure agreement
  2. ② Memorandum of understanding
  3. ③ Acceptable use policy (AUP)
  4. ④ Service-level agreement
▼ Show answer and explanation▲ Hide answer and explanation

Answer: ③ Acceptable use policy (AUP)

Key point: Rules for using company systems = AUP

An acceptable use policy tells users what they may and may not do with company systems and data.

Wrong choices

  • Service-level agreement: An SLA sets service performance between a provider and customer.
  • Non-disclosure agreement: An NDA protects confidential information.
  • Memorandum of understanding: An MOU describes a general agreement between parties.
Practice 5 questions from this unit →

AI-written · Verified · Written by AI. Only units that passed a separate AI check (re-reading facts and numbers) are published. Tell us if you find a mistake.