SecurityX · Domain 1 of 4

SecurityX Domain 1: Governance, Risk, and Compliance

Domain 1 asks you to act as the senior practitioner who turns business requirements, regulations and threat models into a defensible security program, including the new risks that AI adoption brings.

Exam weight
20%
Official objectives
5
Estimated questions estimate
~18
Suggested study time estimate
35–45 hrs

About 20 min read Reviewed October 2026

Overview

Governance, Risk, and Compliance is 20% of the CAS-005 exam and covers five objectives: building governance components, performing risk management, explaining how compliance shapes strategy, running threat-modeling activities, and summarizing the security challenges of artificial intelligence (AI) adoption. Unlike an entry-level treatment, the domain assumes you already know what a policy or a risk register is and tests whether you can choose the right governance mechanism, risk treatment or framework for a specific organization with specific constraints.

The domain exists because architecture and engineering decisions only hold up when they trace back to a requirement someone owns. Threat models built here justify the controls designed in Security Architecture, compliance obligations decide how Security Engineering configures cryptography and data handling, and breach-response and crisis-management planning set the expectations Security Operations must meet when an incident happens.

How it's tested

Expect long scenarios describing an organization, its regulators, its vendors or a planned change, followed by BEST, FIRST or MOST appropriate questions. Several options are usually defensible in isolation; the right one fits the stated authority, obligation or risk appetite. A few items name a framework or regulation and ask which one applies to the facts given.

  • Requirement to mechanism

    A business or regulatory requirement is described and you pick the governance component, framework or document that satisfies it, such as a RACI matrix for unclear ownership or a SOC 2 report for vendor assurance.

  • Risk treatment under constraints

    A quantified or qualitative risk is given alongside appetite, budget or contractual limits, and you choose the treatment or the next risk management activity.

  • Threat model selection

    A design, merger or AI rollout is described and you choose the modeling method, attack surface activity or AI-specific control that addresses the stated threat.

Reasoning it through

A company plans to acquire a smaller competitor and connect both networks within 60 days. Options include running a vulnerability scan, updating the acceptable use policy, performing an attack surface assessment of the acquired company's assets and third-party connections, and buying cyber insurance. The merger is an organizational change that creates unknown, unsanctioned and externally facing assets, so enumerating that attack surface before connecting the networks is the step that informs every other decision.

Objectives 5

Official objectives from the CompTIA outline, in outline order.

1.1 Given a set of organizational security requirements, implement the appropriate governance components.Program documents, awareness, RACI, COBIT and ITIL, asset and change management, GRC tooling and data governance.
What it means
This objective covers the building blocks of a security program: policies, procedures, standards and guidelines; awareness topics such as phishing, social engineering, privacy and operational security; program management through communication, reporting, management commitment and a RACI (responsible, accountable, consulted, informed) matrix; COBIT and ITIL; the asset management life cycle and CMDB; GRC tools; and data governance across production, development, testing and QA environments.
What to understand
Each component solves a different failure: a RACI matrix fixes unclear ownership, a CMDB fixes unknown assets and dependencies, COBIT aligns IT governance with business objectives while ITIL governs service management processes, and GRC tools automate control mapping, compliance tracking and continuous monitoring. Data governance means production data copied into development or QA must be masked or minimized, because lower environments rarely carry production-grade controls.
How it shows up
A scenario describes a symptom such as duplicated effort, an audit finding nobody owns, or real customer data in a test database, and you pick the governance component that removes the root cause.
Common confusion
Candidates pick ITIL when the problem is board-level alignment of IT with business goals (COBIT), or pick more training when the real gap is that no one is accountable (RACI).
1.2 Given a set of organizational security requirements, perform risk management activities.Impact analysis, assessment methods, appetite and tolerance, third-party risk, CIA and privacy risk, crisis and breach response.
What it means
This objective covers impact analysis using extreme but plausible scenarios; quantitative versus qualitative assessment; risk assessment frameworks; appetite, tolerance, prioritization, remediation and validation; third-party, supply chain, vendor and subprocessor risk; availability, confidentiality, integrity and privacy risk considerations such as connected versus disconnected backups, remote journaling, antitampering, data subject rights and data sovereignty; and crisis management and breach response.
What to understand
Risk appetite is the amount of risk leadership is willing to pursue, while tolerance is the acceptable deviation around it, so a residual risk inside tolerance can be accepted with documented sign-off. Disconnected (offline or immutable) backups are the answer to ransomware that encrypts anything reachable, and remote journaling protects integrity by streaming transaction logs off-site. Subprocessor risk means your vendor's vendors handle your data too, so contracts must flow obligations down.
How it shows up
A scenario gives a risk with cost data or a vendor change, and asks for the next activity, such as validating that a remediation actually reduced the risk or reassessing a vendor that added a new subprocessor in another country.
Common confusion
Treating remediation as the end of the process; the outline lists validation separately because a fix that was never verified is still an open risk.
1.3 Explain how compliance affects information security strategies.Industry obligations, standards and frameworks, audits, privacy regulations and cross-jurisdictional issues.
What it means
This objective covers awareness of industry-specific compliance for healthcare, financial, government and utilities sectors; PCI DSS, the ISO/IEC 27000 series and the Digital Markets Act (DMA); benchmarks and foundational best practices; SOC 2, NIST CSF, CIS and Cloud Security Alliance (CSA) guidance; internal and external audits and certifications; GDPR, CCPA, LGPD and COPPA; and cross-jurisdictional concerns such as e-discovery, legal holds, due diligence, due care, export controls and contractual obligations.
What to understand
Regulations are mandatory for those in scope, while frameworks such as NIST CSF and benchmarks such as CIS are adopted voluntarily or required by contract. ISO/IEC 27001 is a certifiable management-system standard, whereas a SOC 2 Type II report is an auditor's attestation on how controls operated over a period. A legal hold suspends normal retention and deletion for data relevant to litigation, and export controls can restrict where encryption technology and technical data may be shipped or accessed.
How it shows up
A multinational scenario lists where data subjects live, what the company sells and who audits it, and you choose the obligation, framework or audit artifact that applies.
Common confusion
Assuming one framework satisfies every regulator; adopting NIST CSF does not by itself meet PCI DSS or GDPR requirements, so control mapping across obligations is still needed.
1.4 Given a scenario, perform threat-modeling activities.Actor motivation and capability, ATT&CK, CAPEC, Kill Chain, Diamond, STRIDE, OWASP, attack surface and attack trees.
What it means
This objective covers actor characteristics (motivations such as financial, geopolitical, activism, notoriety and espionage; resources such as time and money; capabilities such as supply chain access, vulnerability creation and exploit creation); frameworks including MITRE ATT&CK, CAPEC, Cyber Kill Chain, Diamond Model, STRIDE and OWASP; attack surface determination through architecture reviews, data flows, trust boundaries, code reviews, user factors, organizational change and discovery of unsanctioned assets and cloud services; and abuse cases, antipatterns and attack trees or graphs.
What to understand
Modeling without an existing system means working from requirements and design diagrams, typically applying STRIDE to each data flow that crosses a trust boundary and writing abuse cases. Modeling with an existing system starts from what is actually deployed, so discovery, ATT&CK mapping of observed techniques and selection of appropriate controls come first. Actor capability matters: a nation-state that can create vulnerabilities or reach your supply chain justifies controls that a notoriety-driven actor does not.
How it shows up
A scenario describes a design review, an acquisition or a newly discovered shadow cloud tenant and asks which modeling method or attack surface activity to perform.
Common confusion
Using ATT&CK, a catalog of observed adversary behavior, as if it were a design-time method for finding flaws in data flows, which is what STRIDE and abuse cases do.
1.5 Summarize the information security challenges associated with artificial intelligence (AI) adoption.Legal and ethical issues, threats to models, AI-enabled attacks, usage risks and controls on AI assistants.
What it means
This objective covers legal and privacy implications, explainable versus non-explainable models, AI usage policy and ethical governance; threats to the model such as prompt injection, insecure output handling, training data poisoning, model denial of service, supply chain vulnerabilities, model theft, model inversion and insecure plug-in design; AI-enabled attacks such as deepfakes, AI pipeline injections, social engineering and automated exploit generation; usage risks such as overreliance, sensitive information disclosure to and from the model, and excessive agency; and controls for AI-enabled assistants and digital workers.
What to understand
Prompt injection manipulates the model at inference time through crafted input, including instructions hidden in documents it reads, while training data poisoning corrupts what the model learns. Model inversion reconstructs sensitive training data from outputs, and model theft copies the model itself. Excessive agency is granting an assistant more permissions or autonomy than its task needs, and the fixes are least-privilege access, guardrails, human approval for consequential actions, DLP on prompts and outputs, and disclosure of AI usage.
How it shows up
A scenario describes an AI assistant leaking data, taking an unintended action or producing harmful output, and you identify the threat category or the most effective control.
Common confusion
Calling every bad output a hallucination problem when the scenario shows untrusted content steering the model (prompt injection) or downstream code executing model output unchecked (insecure output handling).

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Risk appetite vs. risk tolerance

    Appetite is the overall level of risk leadership is willing to pursue for its objectives, while tolerance is the acceptable variation around that level for a specific risk or metric.

    Remember
    A residual risk inside tolerance can be formally accepted by the risk owner, but one outside tolerance must be treated further or escalated.
    Tested as
    Scenarios that end with whether to accept, mitigate, transfer or avoid a residual risk hinge on comparing it with the stated appetite or tolerance.
    Trap
    Choosing further mitigation for a risk that is already inside tolerance, which spends budget the organization has said it does not need to spend.

  • Quantitative risk analysis (SLE, ARO, ALE)

    Single loss expectancy equals asset value times exposure factor, and annualized loss expectancy equals SLE times annual rate of occurrence.

    Remember
    A control is cost-justified when the ALE it removes is greater than its annual cost, so compare ALE before minus ALE after with the control's yearly cost.
    Tested as
    Expect a calculation where you decide whether a proposed control or insurance policy is worth buying.
    Trap
    Comparing the control's cost with the total ALE instead of with the reduction in ALE that the control actually delivers.

  • RACI matrix

    A RACI matrix assigns, for each activity, who does the work, the single person accountable for it, who is consulted and who is informed.

    Remember
    Each activity should have exactly one accountable party, which is what makes audit findings and control ownership stick.
    Tested as
    Use it when a scenario describes findings that stay open because several teams each assume another team owns them.
    Trap
    Listing several accountable parties, which recreates the diffusion of responsibility the matrix exists to remove.

  • COBIT vs. ITIL

    COBIT is a governance and management framework that aligns IT with enterprise objectives, while ITIL is a library of IT service management practices such as change and incident management.

    Remember
    Board-level alignment and control objectives point to COBIT, and service delivery processes point to ITIL.
    Tested as
    Governance component questions ask which framework fits a stated organizational problem.
    Trap
    Selecting ITIL for an executive accountability or control-objective problem because its change management process sounds relevant.

  • Connected vs. disconnected backups

    Connected backups are reachable from production for fast restores, while disconnected backups are offline, air-gapped or immutable and cannot be altered from the production network.

    Remember
    Ransomware that harvests administrator credentials can encrypt or delete any backup it can reach, so at least one copy must be disconnected or immutable.
    Tested as
    Availability risk scenarios involving ransomware or destructive insiders expect the disconnected option.
    Trap
    Choosing more frequent snapshots on the same storage array, which improves recovery point but not survivability.

  • Subprocessor risk

    A subprocessor is a third party your vendor uses to process your data, such as the cloud host behind a SaaS provider.

    Remember
    Contracts must require notice of subprocessor changes and flow down your security and data-location obligations.
    Tested as
    Vendor scenarios often hinge on a new subprocessor in another jurisdiction, which triggers reassessment and possibly data sovereignty concerns.
    Trap
    Assuming the original vendor assessment still covers data that now flows to a party you never assessed.

  • Legal hold

    A legal hold is an instruction to preserve all data potentially relevant to litigation or investigation, overriding normal retention and deletion schedules.

    Remember
    Once a hold is issued, automated purges covering the relevant data must be suspended, even if policy says to delete it.
    Tested as
    Cross-jurisdictional and e-discovery scenarios test whether you preserve data instead of following routine deletion.
    Trap
    Continuing a scheduled purge because the retention policy requires it, which can amount to spoliation of evidence.

  • SOC 2 Type II vs. ISO/IEC 27001

    A SOC 2 Type II report is an auditor's attestation on the operating effectiveness of controls over a period, while ISO/IEC 27001 certifies that an information security management system meets the standard.

    Remember
    Type II covers operating effectiveness over a period, commonly three to twelve months, while Type I covers control design at a single point in time.
    Tested as
    Vendor assurance questions ask which artifact best shows controls actually worked over time.
    Trap
    Accepting a Type I report as proof that controls operated effectively throughout the year.

  • STRIDE

    STRIDE classifies design threats as spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege.

    Remember
    Each STRIDE category violates one property: authentication, integrity, non-repudiation, confidentiality, availability and authorization respectively.
    Tested as
    Design-stage threat modeling questions, especially where no system exists yet, expect STRIDE applied to data flows across trust boundaries.
    Trap
    Mapping repudiation to confidentiality instead of to non-repudiation controls such as signed, tamper-evident logs.

  • Attack trees and abuse cases

    An attack tree decomposes an attacker goal into alternative and required sub-steps, and an abuse case describes how a feature could be misused by a hostile user.

    Remember
    Both work before code exists, which makes them the tools for modeling a system that is still on the whiteboard.
    Tested as
    Questions about modeling a proposed system point to these methods rather than scans or penetration tests.
    Trap
    Choosing a vulnerability scan or penetration test for a system that has not been built.

  • Prompt injection (direct and indirect)

    Prompt injection is crafted input that overrides a model's instructions, either typed directly by a user or hidden in content the model retrieves, such as a web page or email.

    Remember
    Treat all content entering the model as untrusted, and constrain what the model can do rather than relying on instructions alone to stop it.
    Tested as
    AI scenarios where an assistant follows instructions embedded in a document it summarized are indirect prompt injection.
    Trap
    Labeling it training data poisoning, which corrupts the model during training rather than at inference time.

  • Model inversion vs. model theft

    Model inversion uses repeated queries and outputs to reconstruct sensitive training data, while model theft extracts or replicates the model's parameters or behavior.

    Remember
    Inversion is a privacy breach of the training data, and theft is loss of intellectual property; rate limiting and output restrictions help against both.
    Tested as
    Questions describe heavy, systematic querying and ask which threat it represents based on what the attacker gains.
    Trap
    Calling any high-volume querying model denial of service when the attacker's goal is data or the model itself.

  • Excessive agency

    Excessive agency is giving an AI assistant more functions, permissions or autonomy than its task needs, so a manipulated or mistaken output causes real-world harm.

    Remember
    Fix it with least-privilege access, narrowly scoped tools and human approval before consequential actions such as sending payments or deleting data.
    Tested as
    Digital worker scenarios ask which control limits damage when an assistant acts on bad instructions.
    Trap
    Choosing better prompt wording as the control, which does not remove the permissions that made the harm possible.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Threat modeling with vs. without an existing system

ConceptMeaningKey differenceCommon trap
Without an existing system Modeling a proposed design from requirements, architecture diagrams and data flows Uses STRIDE per data flow, abuse cases and attack trees before anything is built Proposing scans or penetration tests against something that does not exist yet
With an existing system Modeling what is already deployed, including undocumented and unsanctioned assets Starts with discovery and enumeration, then maps observed techniques with ATT&CK and selects controls for gaps Trusting the original design documents instead of discovering what actually runs
Organizational change (merger, acquisition, divestiture) Modeling the attack surface created when organizations connect or separate Focuses on the other party's external assets, third-party connections, accounts and trust relationships Connecting networks first and assessing the acquired environment afterward

Prompt injection vs. training data poisoning vs. insecure output handling

ConceptMeaningKey differenceCommon trap
Prompt injection Crafted input at inference time overrides the model's intended instructions Attack arrives through user input or retrieved content while the model is in use Believing a stronger system prompt alone prevents it
Training data poisoning Manipulated data is inserted into training or fine-tuning sets Corrupts what the model learned, so bad behavior persists for every user Confusing it with a one-off malicious prompt
Insecure output handling Downstream systems trust model output and execute or render it without validation The flaw is in the consuming application, which may pass output to a shell, browser or database Blaming the model when the fix is output encoding and validation in the application

Risk appetite vs. risk tolerance vs. risk threshold

ConceptMeaningKey differenceCommon trap
Risk appetite Broad amount of risk leadership will pursue to reach objectives Strategic and set by the board or executives Treating it as a precise number for each control
Risk tolerance Acceptable variation from appetite for a specific objective or risk Operational and measurable, used to decide accept versus treat Using it interchangeably with appetite in acceptance decisions
Risk threshold A trigger level for a metric that forces escalation or action Converts tolerance into a monitored line, such as a key risk indicator limit Assuming crossing a threshold automatically means the risk must be avoided

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Mitigating a risk already within tolerance

    What candidates pick
    An additional compensating control for a residual risk the scenario says sits within the stated tolerance.
    Why it looks right
    More controls feel safer, and security professionals instinctively reduce risk further.
    Why it's wrong
    Risk management aims for risk within appetite and tolerance at reasonable cost; once residual risk is inside tolerance, the expected action is documented acceptance by the risk owner.

    Clue to watch for Phrases such as 'within the approved tolerance' or 'leadership has accepted' signal formal acceptance, not more spending.

  2. Renewing a vendor on the old assessment

    What candidates pick
    Renewing a SaaS contract because the vendor passed its assessment last year.
    Why it looks right
    The vendor has a clean history and reassessment seems like duplicated effort.
    Why it's wrong
    A new subprocessor, new data type or new hosting region changes the risk, so the earlier assessment no longer covers what is being processed or where.

    Clue to watch for Any mention of a new subprocessor, acquisition of the vendor, or data moving to another country.

  3. Following the retention schedule during litigation

    What candidates pick
    Letting the automated 90-day email purge run because policy requires it.
    Why it looks right
    Policy compliance is normally the correct answer in governance questions.
    Why it's wrong
    A legal hold supersedes routine retention for relevant data, and deleting it can be treated as destruction of evidence.

    Clue to watch for The scenario mentions pending litigation, a regulator's inquiry or counsel's preservation notice.

  4. Scanning a system that does not exist

    What candidates pick
    Running a vulnerability scan or penetration test as the threat-modeling step for a new design.
    Why it looks right
    Scanning is concrete and familiar, and it produces measurable findings.
    Why it's wrong
    Nothing is deployed yet, so threat modeling must work from design artifacts using data flows, trust boundaries, STRIDE, abuse cases and attack trees.

    Clue to watch for Words like 'proposed', 'design phase', 'before development' or 'architecture review'.

  5. Stronger prompts as the AI control

    What candidates pick
    Rewriting the system prompt to forbid the assistant from following embedded instructions.
    Why it looks right
    It addresses the model directly and costs nothing.
    Why it's wrong
    Instructions inside the prompt cannot reliably stop injection; the durable controls limit what the assistant can access and do, add guardrails, and require human approval for consequential actions.

    Clue to watch for The assistant has tool or API access, such as sending email, moving money or changing records.

  6. One framework for every obligation

    What candidates pick
    Adopting NIST CSF as the answer to a scenario listing PCI DSS, GDPR and a customer contract.
    Why it looks right
    NIST CSF is broad and widely respected, so it seems to cover everything.
    Why it's wrong
    Voluntary frameworks organize a program but do not satisfy specific legal and contractual requirements; each obligation still needs mapped, evidenced controls, which is what GRC mapping tools support.

    Clue to watch for The scenario names several regulators, auditors or contractual requirements at once.

Answer framework

For Domain 1 scenarios, work from authority and obligation toward the specific control or activity.

  1. Identify who owns the decision and what authority the scenario grants, because governance answers must respect board, legal and risk-owner roles.
  2. List every binding obligation named, including regulations, contracts, legal holds and data sovereignty, before weighing optional frameworks.
  3. Compare the risk with the stated appetite and tolerance, then choose accept, mitigate, transfer or avoid and plan validation of the result.
  4. Decide whether the system exists yet, then pick design-time modeling or discovery-led modeling accordingly, scaled to the threat actor's capability.
  5. Prefer the option that fixes the root cause in governance, such as ownership, scope or least privilege for AI tools, over a narrow technical patch.

Practice question

A company deploys an AI assistant that reads incoming customer emails, drafts replies and can issue refunds up to $5,000 through a payments API. Testing shows a crafted email can make it issue a refund. Which control MOST effectively limits the impact?

Want more like this? The SecurityX practice test has questions for every domain.

Checklist

0 of 14

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Start with 1.1 and 1.2 because they supply the vocabulary the rest of the domain assumes: program documents, ownership, asset inventory, appetite and tolerance, and risk treatment. Work several ALE calculations by hand until comparing ALE reduction against control cost is automatic. Then study 1.3 by building a one-page table of each regulation and framework in the outline, noting whether it is mandatory, who it applies to and what evidence proves compliance.

Give threat modeling (1.4) focused time, because candidates who know the framework names still miss which one fits the stage of the system. Practice taking a simple data flow diagram, marking trust boundaries and listing STRIDE threats per flow, then repeat for an acquisition scenario that starts with discovery.

The AI objective (1.5) is the most commonly underestimated area. Learn each threat by what the attacker controls and what they gain, and pair it with its control. Afterwards, practice mixed BEST and FIRST questions and review every miss by asking which authority, obligation or tolerance statement you overlooked.

FAQ

How much of SecurityX is Governance, Risk, and Compliance?

The domain is 20% of the CAS-005 exam and contains five objectives. CompTIA does not publish how many questions come from each domain, so treat any per-domain count as an estimate.

Is this domain just memorizing regulations?

No. You need to recognize which regulation or framework applies, but most questions test judgment, such as what to do first when a vendor changes subprocessors or how to treat a risk that is already within tolerance.

Do I need to calculate risk on SecurityX?

Quantitative versus qualitative analysis is in the outline, so be ready to work with SLE, ARO and ALE and to decide whether a control's annual cost is justified by the loss it removes.

How is threat modeling tested?

Scenarios describe a proposed design, an existing environment or an organizational change such as a merger, and you choose the method or attack surface activity that fits. The key distinction is whether the system already exists.

What AI topics does SecurityX cover?

Objective 1.5 covers legal, privacy and ethical issues, threats to models such as prompt injection and model inversion, AI-enabled attacks such as deepfakes, and controls for AI assistants such as guardrails, DLP and limiting permissions.

How does this domain differ from Security+ governance content?

Security+ checks that you can identify governance concepts. SecurityX expects you to implement them for an organization with competing obligations, vendors and risk appetite, and to choose between several reasonable options.

How does Domain 1 connect to the rest of the exam?

Threat models and risk decisions from this domain justify the controls designed in Security Architecture, and breach-response and crisis-management planning define what Security Operations must deliver during an incident.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 1 knowledge

You have worked through governance components, risk treatment, compliance obligations, threat modeling and AI adoption risks. Practice applying them to multi-constraint scenarios under exam timing.

Take the SecurityX practice test Check your SecurityX readiness

Keep going