7 Governance, Risk, and Compliance Free Online FlashCards

What roles do governance, risk management, and compliance play?

Governance sets security direction and accountability; risk management helps leaders address uncertainty; compliance helps demonstrate that applicable obligations are met.

How do a security policy and a standard differ?

A policy states what is required and why. A standard defines the specific mandatory requirements that implement that policy.

Who is accountable for security decisions when responsibilities are delegated?

Senior leaders approve strategy and risk tolerances, while system and data owners make decisions for the resources they are responsible for. Delegation may occur, but accountability should remain clear.

What is cybersecurity risk, and what does its assessment consider?

Risk is the possibility that a threat will exploit a vulnerability and cause harm. Assessment considers threats, vulnerabilities or predisposing conditions, likelihood, and potential impact.

What are the main stages of the risk-management cycle?

Establish context, assess risk, respond, then monitor and communicate. Reassess when conditions change.

How do risk mitigation and risk avoidance differ?

Mitigate by reducing likelihood or impact with controls; avoid by stopping or changing the activity that creates the risk.

What distinguishes inherent risk from residual risk?

Inherent risk exists before relevant controls are considered; residual risk remains after controls are applied.

What does compliance mean, and why does it not guarantee security?

Compliance means meeting applicable obligations from sources such as laws, regulations, contracts, industry or government requirements, and internal policies. Compliance alone does not guarantee security.

What does an audit evaluate?

An audit is a systematic, documented examination of evidence against defined criteria. It can assess whether controls are designed appropriately, implemented, and operating as expected.

What are key stages in managing third-party security risk?

Assess suppliers before engagement in proportion to their risk, set appropriate contractual security requirements, monitor them throughout the relationship, and manage secure exit.

How do procedures differ from guidelines?

A procedure gives the steps for performing a task; a guideline offers recommended practices with more flexibility than a standard.

What is a key limitation of a low/medium/high risk matrix?

A low/medium/high matrix helps prioritize risks; it is not a precise measurement of loss.