CompTIA Security+ SY0-701 · Free study guide

Objective 5.1 — Establish effective security governance

Governance establishes who may make security decisions, which outcomes are required, and how accountability is demonstrated. Documentation has layers. A policy states management intent and mandatory direction. A standard defines required, measurable rules. A procedure gives repeatable steps. A guideline offers recommended judgment where flexibility is appropriate.

An acceptable-use policy sets expectations for organizational technology. Information-security, continuity, disaster-recovery, incident-response, software-development, and change-management policies assign broad direction. Supporting standards may define password, access-control, physical-security, and encryption requirements. Procedures translate them into onboarding, offboarding, change, and playbook actions.

Structure and responsibility

Boards and executives set risk direction and oversight. Committees coordinate decisions across functions. Government entities may impose or interpret requirements. Centralized governance can increase consistency; decentralized structures can adapt locally but need shared minimums and escalation.

Data and system roles must be explicit. Owners make accountable decisions about classification, access, and risk. Custodians or stewards operate controls and maintain data. Controllers determine purposes and means of processing in relevant privacy contexts; processors act on a controller’s behalf. Titles vary, so follow the scenario’s defined responsibilities.

External considerations include legal, regulatory, contractual, industry, local, national, and global obligations. Governance should map each requirement to an owner, control, evidence, review interval, and exception process. Copying a template without connecting it to operations does not create compliance.

Keep governance alive

Policies and standards require communication, acknowledgement where appropriate, monitoring, and revision. Trigger review after material business, technology, threat, or regulatory change—not only on an annual calendar. Measure whether controls achieve the intended outcome.

Exceptions should identify scope, rationale, compensating controls, risk owner, approval, and expiry. Repeated exceptions may show that a standard is unrealistic or the organization is avoiding necessary investment.

Decision rule: distinguish policy, standard, procedure, and guideline; assign accountable roles; map external duties; and require evidence plus periodic revision.