Security Operations, Governance, and Risk Management
Security as a business function
Risk perspective
Security decisions should balance likelihood, impact, cost, and operational reality. Governance provides structure so that technical teams, leaders, and auditors make consistent decisions.
Core governance terms
| Term | Meaning |
|---|---|
| Policy | High-level rule or direction set by leadership |
| Standard | Specific mandatory requirement that supports policy |
| Procedure | Step-by-step method to carry out a task |
| Control | Measure that reduces risk |
Risk language
Governance helps scale security
When policies, standards, and ownership are clear, security becomes repeatable instead of dependent on heroics.
Compliance vs security
Compliance
- Meets required rules or audits
- May focus on minimum acceptable controls
Security
- Reduces real-world risk
- Often requires going beyond minimum compliance
Which item is usually a high-level leadership directive?
Policies are broad rules set by leadership.
Correct answer: Policy
What is residual risk?
No set of controls reduces risk to zero.
Correct answer: The risk that remains after controls are in place
Which statement best distinguishes compliance from security?
Organizations can be compliant and still be insecure.
Correct answer: Security may require more than minimum rules
Why are standards useful after a policy is written?
Standards make policy actionable and testable.
Correct answer: They convert broad policy goals into specific mandatory requirements