Study Hub / CompTIA Security+ (SY0-701) / Domain 5.0
CompTIA Security+ (SY0-701) Domain 5.0: Security Program Management & Oversight — Explained
Domain 5.0 is the management layer of security: how organizations decide what "secure enough" means, prove it to auditors, manage risk as a business function, and keep humans — the most attacked component — from being the weak link.
5.1 — Governance: policies, roles, and the security program
Governance is the system of rules and accountability that makes security an organizational function instead of one person's hobby.
- Policies — the high-level "what and why" (e.g., "all laptops must use full-disk encryption"). Written by management, mandatory.
- Standards — the specific "how" that implements a policy (e.g., "AES-256 via BitLocker").
- Procedures — step-by-step instructions for tasks (e.g., "how to onboard a new hire's accounts").
- Guidelines — recommendations, not mandates (e.g., "consider a password manager").
Key roles: the data owner (accountable for the data, usually a business executive), the steward/custodian (maintains it day to day — often IT), and the privacy officer (owns compliance with privacy law). A RACI-style split the exam respects: owners decide, custodians implement.
5.2 — Risk management in plain English
Risk is the possibility that a threat exploits a vulnerability and causes impact. Risk management is the business process of dealing with that possibility:
- Risk assessment — identify assets, threats, and vulnerabilities; estimate likelihood and impact. Qualitative (high/medium/low) or quantitative (dollars and probabilities).
- Risk treatment — four options: mitigate (add controls), transfer (buy insurance, outsource), accept (document it and move on), avoid (stop doing the risky thing).
- Risk register — the living document tracking each known risk, its owner, and its treatment.
- Residual risk — what remains after controls. It is never zero; management formally accepts it.
5.3 — Compliance, audits, and assessments
Compliance means operating inside the rules someone else set — laws, regulations, contracts, and frameworks.
- Regulations — GDPR (EU privacy), HIPAA (US health data), PCI DSS (card payments), SOX (financial reporting). Each defines what must be protected and the penalties for failing.
- Audits — independent verification. Internal audits check ourselves; external audits check us for someone else (a regulator, a customer). An audit's output is findings, not fixes.
- Penetration test vs. vulnerability scan — a scan lists weaknesses automatically; a pentest has humans actively exploit them to prove impact. Scans are broad and shallow; pentests are narrow and deep.
- Attestation — a formal statement that controls are in place (e.g., a SOC 2 report), used to prove compliance to customers without exposing internals.
5.4 — Security awareness: the human layer
Humans are attacked more than technology because humans are easier to fool. The awareness program is the control:
- Phishing simulations — sending fake phishing emails to staff, then training whoever clicks. The metric is the click rate trending down over time.
- Onboarding and offboarding — accounts provisioned on day one with least privilege; disabled the hour someone leaves. Orphaned accounts are a classic breach path.
- Acceptable use and clean-desk policies — the everyday rules: lock your screen, don't plug in found USB drives, report suspicious emails instead of investigating them yourself.
- Role-based training — developers get secure-coding training; finance gets business-email-compromise training; everyone gets phishing training. One generic video for all roles is a checkbox, not a program.
The must-memorize table: risk treatment options
Four verbs that answer every "what should management do about this risk?" question.
| Option | Meaning | Example |
|---|---|---|
| Mitigate | Reduce the risk with controls | Add MFA to cut account-takeover risk |
| Transfer | Shift the financial impact to someone else | Buy cyber insurance; outsource to a provider with an SLA |
| Accept | Acknowledge it and do nothing further | Document a low-likelihood risk and get sign-off |
| Avoid | Eliminate the risk by stopping the activity | Decommission the legacy system instead of securing it |
Try it: 4 sample questions
Sample questions to check your understanding of this domain. Answers and full reasoning are tucked under each one.
1. A risk assessment finds a legacy server that cannot be patched. The business needs it for six more months. Management buys an insurance policy covering breach costs from that server and documents the decision. Which risk treatments are these?
- A. A. Mitigate and avoid
- B. B. Transfer and accept
- C. C. Mitigate and transfer
- D. D. Accept and avoid
Show answer & reasoning
B. The insurance policy transfers the financial impact to the insurer. Documenting the remaining risk and proceeding anyway is acceptance — formal, written, signed off. Nothing here reduces the likelihood (not mitigation) and the server stays running (not avoidance).
2. An auditor asks for evidence that terminated employees lose system access promptly. Which process should the company demonstrate?
- A. A. The password complexity standard
- B. B. The offboarding procedure with same-day account deprovisioning
- C. C. The firewall change-request log
- D. D. The backup retention schedule
Show answer & reasoning
B. Offboarding is the procedure that revokes access when someone leaves — the auditor wants to see it happen promptly (same day, ideally same hour), because orphaned accounts are a known breach path. The other options are real controls but answer different questions entirely.
3. A hospital must comply with HIPAA and a retailer with PCI DSS. What do these have in common?
- A. A. Both are voluntary frameworks with no penalties
- B. B. Both are regulations defining required protections and penalties for failure
- C. C. Both only apply to US federal agencies
- D. D. Both are internal company policies
Show answer & reasoning
B. HIPAA (health data) and PCI DSS (card data) are both externally imposed rule sets: they define what must be protected and carry real penalties. They are not voluntary (A), not limited to federal agencies (C), and not internal policies (D) — that external, mandatory character is what makes them regulations.
4. After a phishing simulation, 22% of staff clicked the fake link. What is the correct next step for the awareness program?
- A. A. Fire the employees who clicked
- B. B. Train the clickers immediately and re-test later, tracking the rate over time
- C. C. Disable email for the departments with the most clicks
- D. D. Declare the simulation a failure and stop running them
Show answer & reasoning
B. Simulations are diagnostic, not punitive — the click rate is a metric, and the program's job is to drive it down through targeted training and repeated testing. Punishing clickers (A) just teaches people to hide mistakes; the other options abandon the program instead of improving it.
This was one domain. The simulator drills all 5.
This free preview covered Security Program Management & Oversight (Domain 5.0, 17%). Not covered here: Threats, Vulnerabilities & Mitigations (Domain 2.0, 22%); Security Operations (Domain 4.0, 28%). The two highest-weight domains — hands-on threat scenarios, incident response, and security operations — stay in the paid guide and practice bank. The ByteBar Practice Exam Simulator drills every domain with 1,000 exam-style questions — $9.99 one-time unlocks all 28 exams. Prefer to read? The full Security+ Study Guide is in the ByteBar shop on Etsy.
Practice Exam Simulator — $9.99 one-time, all 28 exams Full Study Guides on EtsyWant reps? Try the free Security+ quiz.