Governance, Risk, and Compliance: Domain 5 Without Bureaucracy Fog
Policies, risk analysis, third-party risk, audits, and security awareness—Security+ Domain 5 topics explained for practical exam scenarios.
Domain 5 carries 20% of the SY0-701 exam, and it feels different from the technical domains. There are fewer port numbers and cipher suites, more policies, risk formulas, and organizational roles. Candidates who dismiss Domain 5 as "soft" often lose enough points to fail—because CompTIA loves scenarios that ask which document type, risk treatment, or assessment method fits a described situation.
The goal of this post is not to turn you into a compliance auditor. It is to give you enough practical context to answer scenario questions without drowning in bureaucracy fog.
Governance: The Document Hierarchy
Organizations express security expectations through a hierarchy of documents. The exam tests whether you know what each artifact does, not whether you can draft one from scratch.
| Artifact | Binding level | Purpose | Example |
|---|---|---|---|
| Policy | Mandatory | High-level rules approved by leadership | "All remote access requires MFA" |
| Standard | Mandatory | Specific technical requirements derived from policy | "MFA must use FIDO2 or TOTP; SMS-only is prohibited" |
| Procedure / SOP | Mandatory | Step-by-step instructions for a task | "How to provision a new VPN user account" |
| Guideline | Advisory | Recommended practices, flexible implementation | "Prefer hardware security keys for admin accounts" |
| AUP (Acceptable Use Policy) | Mandatory (user agreement) | Defines permitted and prohibited user behavior | "Personal cloud storage may not be used for company data" |
Exam trap: A scenario describes "recommended but not required encryption settings for legacy systems." That is a guideline, not a policy or standard. Policies and standards are mandatory; guidelines are flexible.
Roles You Should Recognize
| Role | Responsibility |
|---|---|
| CISO / CSO | Executive security strategy and program oversight |
| Data owner | Classifies data, defines access requirements, accepts risk |
| Data custodian | Implements controls on behalf of the owner (IT ops, DBAs) |
| Data controller / processor | Privacy regulation context (GDPR)—controller decides purpose; processor handles data on controller's behalf |
| DPO (Data Protection Officer) | Oversees privacy compliance program |
Scenario: A marketing manager wants to export customer email lists to a personal spreadsheet for a campaign. The question asks who should approve this. The data owner (likely a VP of Marketing or Chief Privacy Officer depending on classification) must authorize use that deviates from standard handling—not the IT help desk, and not the employee themselves.
Exam trap: "Custodian" sounds like ownership, but custodians implement controls; they do not accept risk. Risk acceptance belongs to the owner or management.
Risk Management: Qualitative and Quantitative
Risk is the potential for loss resulting from a threat exploiting a vulnerability. CompTIA tests both qualitative approaches (Low/Medium/High scales) and quantitative formulas.
The Core Formula
ALE = SLE × ARO
| Term | Meaning | Example |
|---|---|---|
| SLE (Single Loss Expectancy) | Cost of one incident | Asset value × exposure factor |
| ARO (Annualized Rate of Occurrence) | How often the incident happens per year | 0.5 = once every two years |
| ALE (Annualized Loss Expectancy) | Expected annual cost of the risk | SLE × ARO |
Worked example: A server worth $100,000 has a fire risk with an exposure factor of 40% (the fire would destroy 40% of the asset value).
- SLE = $100,000 × 0.40 = $40,000
- If fires occur once every 4 years, ARO = 0.25
- ALE = $40,000 × 0.25 = $10,000 per year
A safeguard costing $8,000/year that eliminates the fire risk saves $10,000/year in expected loss—it is worth implementing. A safeguard costing $15,000/year is not, unless non-financial factors (regulatory penalty, reputation) apply.
Exam trap: Questions may give you SLE and ALE and ask for ARO. Rearrange: ARO = ALE ÷ SLE. Do the math on scratch paper; do not guess.
Risk Treatment Options
Once risk is assessed, organizations choose a treatment:
| Treatment | Meaning | Example |
|---|---|---|
| Mitigate | Reduce likelihood or impact with controls | Deploy EDR, patch servers, enforce MFA |
| Transfer | Shift financial impact to a third party | Cyber insurance, outsourcing with liability clauses |
| Accept | Acknowledge the risk without additional controls | Documented decision with owner sign-off |
| Avoid | Eliminate the activity causing the risk | Stop processing credit cards; discontinue the product line |
Scenario: A small clinic cannot afford a full SIEM deployment. Leadership documents that they accept the risk of delayed breach detection, assigns the clinic administrator as risk owner, and sets a 6-month review date. This is risk acceptance—valid if documented. Simply ignoring the risk without documentation is not.
Exam trap: "Purchasing cyber insurance" is transfer, not mitigation. Insurance does not reduce the likelihood of a breach; it shifts financial consequences.
Residual Risk
Controls reduce but rarely eliminate risk. Residual risk is what remains after controls are applied. Management must accept residual risk explicitly. A question that describes "risk after implementing the firewall" is asking about residual risk.
Third-Party and Supply Chain Risk
Modern organizations depend on vendors, MSPs, cloud providers, and SaaS platforms. Each third party extends your attack surface.
Due Diligence and Ongoing Monitoring
Before onboarding a vendor:
- Questionnaire — security practices, certifications, incident history
- Contract review — data handling, breach notification timelines, right-to-audit clauses
- Technical assessment — SSO integration, API permissions, data residency
- Privacy review — DPA (Data Processing Agreement) if personal data is involved
After onboarding, continuous monitoring replaces one-time checks. Vendor breaches happen to organizations you already trust.
Scenario: HR adopts a new payroll SaaS platform. The security team should require SSO/MFA integration, review the vendor's SOC 2 report, confirm data residency meets regulatory requirements, and define offboarding procedures before go-live. A question asking what was missed when "the vendor had a breach six months after deployment with no prior review" expects you to identify absent due diligence.
Agreement Types
| Agreement | Purpose |
|---|---|
| MOU (Memorandum of Understanding) | Non-binding statement of intent to cooperate |
| MSA (Master Service Agreement) | Overarching contract terms for ongoing services |
| BPA (Blanket Purchase Agreement) / SLA (Service Level Agreement) | Specific service terms, performance metrics, penalties |
| NDA (Non-Disclosure Agreement) | Protects confidential information shared during engagement |
| DPA (Data Processing Agreement) | Privacy regulation requirement for processor relationships |
Exam trap: An MOU is not legally binding in the way an MSA is. A scenario about "formalizing a partnership with defined penalties for downtime" points to SLA or MSA, not MOU.
Assessments, Audits, and Testing
CompTIA distinguishes several assessment types. Confusing them costs points.
| Assessment | What it does | Who typically performs it |
|---|---|---|
| Vulnerability assessment | Identifies weaknesses (breadth) | Internal team or vendor with scanning tools |
| Penetration test | Validates exploitability through simulated attack (depth) | External ethical hackers with rules of engagement |
| Internal audit | Evaluates controls against policy/standard | Internal audit team |
| External audit | Independent verification against a framework (ISO 27001, SOC 2) | Certified third-party auditors |
| Tabletop exercise | Walks through an incident scenario verbally | IR team, leadership, cross-functional stakeholders |
| Compliance audit | Verifies adherence to regulatory requirements (PCI DSS, HIPAA) | QSA (Qualified Security Assessor) or internal compliance team |
Scenario: After a PCI DSS audit, the assessor issues findings that wireless networks use WPA2-PSK instead of WPA2-Enterprise. This is a compliance audit finding. Remediation requires a documented plan with owners, deadlines, and retest evidence.
Exam trap: "The team ran Nessus against all servers" is a vulnerability assessment, not a penetration test—even if the word "test" appears in the tool name.
Compliance Frameworks as Drivers
You do not need to memorize every control in PCI DSS or HIPAA. You need to know what type of organization each framework applies to and what it drives:
| Framework / Regulation | Applies to | Key theme |
|---|---|---|
| PCI DSS | Organizations handling payment card data | Network segmentation, encryption, access control |
| HIPAA | US healthcare entities and business associates | PHI protection, breach notification |
| GDPR | Processing EU residents' personal data | Consent, data subject rights, DPO, breach notification within 72 hours |
| SOX | Publicly traded US companies | Financial reporting integrity, IT general controls |
| ISO 27001 | Any organization seeking certifiable ISMS | Risk-based approach, statement of applicability |
Scenario: A US hospital discovers unauthorized access to patient records. Besides IR, the organization must follow HIPAA breach notification requirements. The exam may ask what regulation applies—not what specific HIPAA section number.
Security Awareness and Training
Humans are both the target (social engineering in Domain 2) and a control (awareness in Domain 5). Effective programs share common traits:
- Role-based — developers get secure coding training; finance gets BEC awareness
- Continuous — annual checkbox training fails; monthly micro-modules and simulations work better
- Measured — phishing simulation click rates tracked over time with coaching, not punishment
- Tied to policy — AUP acknowledgment on hire and annually thereafter
Scenario: A company runs a phishing simulation. 30% of employees click the link. The best next step is targeted training for clickers with follow-up simulations, not public shaming or immediate termination. The exam favors constructive approaches that improve behavior.
Scenario Patterns That Repeat on the Exam
Pattern 1: Business Wants to Skip a Control
Finance requests an exception to MFA for a legacy application that "cannot support it."
- Wrong answer: Disable MFA globally
- Right answer: Document risk acceptance with owner sign-off, set expiry date, implement compensating controls (IP restriction, PAM session recording), plan application replacement
Pattern 2: New SaaS Adoption
Marketing purchases a CRM without involving security.
- Missing steps: Vendor security review, DPA if PII involved, SSO/MFA integration, data classification, offboarding procedure
- Exam asks: What should have happened first? → Vendor risk assessment before deployment
Pattern 3: Post-Audit Remediation
An audit finds privileged accounts without MFA.
- Correct response: Assign remediation owners, set deadlines, implement MFA, collect evidence, schedule retest
- Wrong response: Argue the finding is invalid; accept risk without documentation; fix only the accounts the auditor happened to check
Pattern 4: Quantitative Risk Decision
Given SLE, ARO, and safeguard cost, should the organization implement the control?
- Calculate ALE
- Compare ALE to annual safeguard cost
- If safeguard cost < ALE, mitigation is financially justified
- Remember non-financial factors (regulatory fines, reputation) may override pure math
Practice Tips for Domain 5
- Build a document hierarchy flashcard: Policy → Standard → Procedure → Guideline → AUP. One example each.
- Work three ALE problems by hand with different given variables (sometimes ARO is missing, sometimes SLE).
- List the four risk treatments and write one scenario example for each.
- Distinguish pen test from vuln assessment in one sentence each—this appears in both Domain 4 and Domain 5.
- For every compliance framework, memorize one sentence: who it applies to and what it protects.
Domain 5 is how security becomes an organizational system. If Domains 2–4 are the craft—firewalls, crypto, identity—Domain 5 is the charter that keeps the craft funded, measured, and accountable. Candidates who respect that distinction pass scenario questions that others dismiss as "just paperwork."