CompTIA Security+ ExamStudy Topic
Governance, Risk, and Accountability Study Guide
Connect policy, ownership, risk treatment, privacy, vendor assurance, and lifecycle decisions.
Topic Overview
A risk decision should state the asset or process, scenario, likelihood and impact assumptions, existing controls, owner, and proposed treatment. Distinguish reducing risk from accepting it, transferring defined consequences, or avoiding the activity. Residual risk remains a decision for an authorized owner.
Policies set direction, standards specify mandatory requirements, and procedures describe approved steps. Exceptions need a rationale, owner, compensating measures where appropriate, and review timing. Without these, a temporary deviation can become an unmanaged permanent condition.
Follow information through collection, use, sharing, retention, and disposal. Data owners make business handling decisions; custodians implement approved controls. Evaluate third parties and measurable commitments in context. Legal and contractual duties depend on the actual facts and governing requirements, so do not invent universal deadlines.
- Treating insurance as elimination of technical or operational risk.
- Using a metric without its population and measurement limitations.
- Keeping data forever without an approved retention purpose.
- Leaving temporary exceptions without an owner or expiry review.
Checkpoint Quiz
Test your understanding of Governance, Risk, and Accountability
These questions are for study practice only and are not official exam questions.
1. A risk workshop evaluates how likely an event is and how severe its consequences would be. What is it estimating?
2. An exercise defines annualized loss expectancy as single loss expectancy times annual rate of occurrence. SLE is $40,000 and annual rate is 0.20. What is ALE?
3. A risk owner formally agrees to retain a documented residual risk because further treatment is not justified under the organization criteria. Which treatment is illustrated?
4. Before setting recovery priorities, an organization identifies critical processes, outage impacts, and required dependencies. What activity is this?
5. A team reduces exposure by replacing broad network access with narrowly permitted connections, but some risk remains. Which treatment is this?
6. A supplied quantitative model defines single loss expectancy as asset value multiplied by exposure factor. Asset value is $200,000 and exposure factor is 0.25. What is single loss expectancy?
7. An organization purchases insurance for certain cyber-related financial losses. What should it understand about this risk treatment?
8. A business decides not to launch a proposed service because its risks exceed the organization tolerance and no acceptable design is available. Which treatment is represented?
9. A document offers recommended practices but explicitly permits alternatives when appropriate. How does this most closely differ from a mandatory standard?
10. A team labels records according to sensitivity and handling requirements before selecting access and retention controls. What process is this?
Frequently asked questions
Who accepts residual risk?
The organization designated authorized risk owner makes and records that decision under its governance process.
How is a standard different from a procedure?
A standard states mandatory specifics; a procedure gives the steps to perform an activity. The organization document framework defines their authority.
What is data minimization?
Collect and retain information appropriate to the legitimate stated need rather than gathering more sensitive details by default.
Are incident notification deadlines universal?
No. The responsible legal, privacy, and incident teams must evaluate applicable laws, contracts, and facts before deciding required notifications.
