Overview
Security Program Management and Oversight is 20% of the exam and covers the governance, risk and compliance side of security, newly emphasized in SY0-701. It has six objectives. Governance covers policies, standards, procedures, guidelines, governance structures, roles and responsibilities, and regulatory considerations. Risk management covers the risk process: identification, assessment (qualitative and quantitative), analysis with metrics like ARO, SLE and ALE, risk register, appetite and tolerance, and strategies to accept, transfer, avoid or mitigate. Third-party risk covers vendor assessment, agreements such as SLAs and MOUs, and supply chain risk. Compliance covers reporting, consequences of non-compliance, privacy and regulatory requirements. Audits and assessments cover internal and external audits, attestation, and penetration testing. Security awareness covers phishing recognition, anomalous behavior, user training and reporting.
The exam rewards understanding how security is governed and risk is managed, including the risk calculations, which are a distinctive, tested element of this domain.
How it's tested
Security+ questions in this domain describe a governance, risk, third-party, compliance or awareness need and ask which concept, document or calculation applies. Security+ questions are vendor-neutral and scenario-based, with some performance-based, so read the situation and choose the security concept, control or response it points to before answering.
-
Governance document
A governance need is described, and you choose the policy, standard, procedure or guideline.
-
Risk process or calculation
A risk need is described, and you choose the risk strategy or compute a value such as ALE.
-
Third-party, compliance or awareness
A vendor, compliance or training need is described, and you choose the agreement, requirement or practice.
An organization must decide how to treat a risk whose potential loss far exceeds the cost of buying cyber insurance to cover it. Accepting the risk leaves the loss exposed, and avoiding the activity may not be feasible. Transferring the risk, by purchasing insurance so a third party bears the financial impact, is the appropriate strategy when the cost of transfer is justified by the potential loss, which is the risk-management choice the exam expects for this situation.
Domains 6
Official domains from the CompTIA outline, in outline order.
5.1 Summarize elements of effective security governancePolicies, standards, procedures, guidelines and roles.
- What it means
- This covers security governance elements: guidelines, policies (acceptable use, information security, business continuity, incident response and others), standards, procedures (change management, onboarding and offboarding, playbooks), external considerations such as regulatory and legal, governance structures like boards and committees, and roles and responsibilities including owners, controllers and processors.
- What to understand
- Governance sets direction through a hierarchy of documents: policies state intent, standards define specific requirements, procedures give step-by-step instructions, and guidelines offer recommendations. Clear roles and governance structures assign accountability. Distinguishing these documents and roles is a frequently tested element.
- How it shows up
- A governance need is described, and you must choose the document type or role.
- Common confusion
- Confusing policies, standards, procedures and guidelines, which differ in specificity and enforceability.
5.2 Explain elements of the risk management processRisk identification, assessment, analysis and strategies.
- What it means
- This covers the risk management process: risk identification, assessment types (ad hoc, recurring, one-time, continuous), qualitative and quantitative analysis with metrics such as single loss expectancy, annualized rate of occurrence and annualized loss expectancy, the risk register with likelihood and impact, risk appetite and tolerance, and risk strategies to transfer, accept, avoid or mitigate, plus business impact analysis terms like RTO, RPO, MTTR and MTBF.
- What to understand
- Risk management identifies and assesses risks, quantifies them where possible, and chooses a response. Quantitative analysis uses SLE (single loss expectancy) times ARO (annualized rate of occurrence) to get ALE (annualized loss expectancy), which guides decisions. The four strategies are transfer, accept, avoid and mitigate. Knowing the process and the calculations is distinctive and tested.
- How it shows up
- A risk need is described, and you must choose the strategy or compute a risk value.
- Common confusion
- Confusing the risk strategies, or miscalculating ALE from SLE and ARO.
5.3 Explain the processes associated with third-party risk assessment and managementVendor assessment, agreements and supply chain.
- What it means
- This covers third-party risk: vendor assessment through penetration testing, audits and questionnaires, supply chain analysis, agreement types such as service level agreements, memoranda of understanding, master service agreements, non-disclosure agreements and business partner agreements, and ongoing vendor monitoring and rules of engagement.
- What to understand
- Organizations depend on vendors, so third-party risk must be assessed before and during engagements, and formalized in the right agreement: an SLA defines service levels, an NDA protects confidentiality, and an MOU records intent. Supply chain risk extends to suppliers' suppliers. Knowing the assessment process and agreement types is the tested knowledge.
- How it shows up
- A vendor-risk need is described, and you must choose the assessment approach or agreement type.
- Common confusion
- Confusing the agreement types, such as an SLA with an MOU or an MSA.
5.4 Summarize elements of effective security complianceReporting, consequences, privacy and regulations.
- What it means
- This covers compliance: compliance reporting (internal and external), consequences of non-compliance such as fines, sanctions, reputational and legal exposure, compliance monitoring through due diligence, attestation and automation, and privacy considerations including legal implications, data subject rights and controller versus processor roles.
- What to understand
- Compliance means meeting legal, regulatory and contractual requirements, with real consequences for failure. Monitoring and attestation demonstrate compliance, and privacy regulations impose specific obligations and rights. Understanding what compliance requires and the consequences of failing it is the expected knowledge.
- How it shows up
- A compliance or privacy need is described, and you must choose the compliance element or consequence.
- Common confusion
- Confusing compliance with security; compliance meets external requirements, which overlaps with but is not the same as being secure.
5.5 Explain types and purposes of audits and assessmentsInternal and external audits, attestation and penetration testing.
- What it means
- This covers audits and assessments: internal audits including self-assessments and committee oversight, external audits including regulatory and examinations, attestation, and penetration testing with its reconnaissance types and environments such as known, partially known and unknown.
- What to understand
- Audits and assessments verify that controls work and requirements are met: internal audits are self-directed, external audits are independent, and penetration testing actively tests defenses, with the tester's knowledge level (known, partially known, unknown environment) defining the engagement. Knowing the types and purposes is the tested knowledge.
- How it shows up
- An assessment need is described, and you must choose the audit or penetration testing type.
- Common confusion
- Confusing internal with external audits, or the penetration testing knowledge levels.
5.6 Implement security awareness practicesPhishing recognition, training and reporting.
- What it means
- This covers security awareness practices: phishing recognition and anti-phishing campaigns, recognizing anomalous behavior, user guidance and training on topics such as policies, operational security and reporting, and developing and monitoring the awareness program.
- What to understand
- People are a key line of defense, so awareness programs train users to recognize phishing and anomalous behavior and to report incidents, and anti-phishing campaigns test and reinforce this. A monitored, ongoing program reduces human-driven risk. Understanding how to build and run awareness practices is the expected knowledge.
- How it shows up
- A human-risk or training need is described, and you must choose the awareness practice.
- Common confusion
- Treating awareness training as a one-time event rather than an ongoing, monitored program.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Governance documents
Policies, standards, procedures, guidelines.
- Remember
- Differ in specificity and enforceability.
- Tested as
- Governance questions.
- Trap
- Confusing the document types.
-
Roles and responsibilities
Owners, controllers, processors.
- Remember
- Assign accountability.
- Tested as
- Governance questions.
- Trap
- Confusing the roles.
-
Risk strategies
Transfer, accept, avoid, mitigate.
- Remember
- Choose by cost and impact.
- Tested as
- Risk questions.
- Trap
- Confusing the strategies.
-
SLE, ARO, ALE
Single loss, annual rate, annual loss expectancy.
- Remember
- ALE = SLE x ARO.
- Tested as
- Risk calculation questions.
- Trap
- Miscalculating ALE.
-
Risk register
Records risks, likelihood and impact.
- Remember
- Tracks and prioritizes risk.
- Tested as
- Risk questions.
- Trap
- Overlooking the register.
-
Risk appetite and tolerance
How much risk is acceptable.
- Remember
- Guides risk decisions.
- Tested as
- Risk questions.
- Trap
- Confusing appetite with tolerance.
-
Third-party agreements
SLA, MOU, MSA, NDA, BPA.
- Remember
- Match agreement to the need.
- Tested as
- Vendor questions.
- Trap
- Confusing the agreements.
-
Supply chain risk
Risk from vendors and their suppliers.
- Remember
- Extends beyond direct vendors.
- Tested as
- Vendor questions.
- Trap
- Overlooking indirect suppliers.
-
Compliance consequences
Fines, sanctions, reputational, legal.
- Remember
- Non-compliance has real cost.
- Tested as
- Compliance questions.
- Trap
- Treating compliance as optional.
-
Audit types
Internal, external, attestation, penetration testing.
- Remember
- Verify controls and requirements.
- Tested as
- Audit questions.
- Trap
- Confusing internal and external.
-
Security awareness
Phishing training and reporting.
- Remember
- An ongoing, monitored program.
- Tested as
- Awareness questions.
- Trap
- Treating it as one-time.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Policy vs. standard vs. procedure vs. guideline
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Policy | States intent and direction | High-level, mandatory | Confusing with a standard |
| Standard | Specific mandatory requirement | Defines the how precisely | Confusing with a guideline |
| Procedure | Step-by-step instructions | Operational detail | Confusing with a policy |
| Guideline | Recommendation | Advisory, not mandatory | Treating as mandatory |
Risk strategies
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Transfer | Shift to a third party | Insurance or contracts | Confusing with accept |
| Accept | Tolerate the risk | Within appetite | Confusing with avoid |
| Avoid | Stop the risky activity | Eliminates the risk | Confusing with mitigate |
| Mitigate | Reduce likelihood or impact | Controls | Confusing with transfer |
SLE vs. ARO vs. ALE
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| SLE | Loss from one event | Single loss expectancy | Confusing with ALE |
| ARO | Events expected per year | Annualized rate | Confusing with SLE |
| ALE | SLE x ARO | Annual loss expectancy | Miscalculating it |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Accept a severe risk
- What candidates pick
- Accept a risk whose potential loss far exceeds the cost of insuring against it.
- Why it looks right
- Accepting avoids spending.
- Why it's wrong
- When the potential loss greatly exceeds the transfer cost, transferring the risk, for example via insurance, is appropriate rather than accepting it.
Clue to watch for The potential loss is large and insurance is affordable.
-
Guideline is mandatory
- What candidates pick
- Enforce a guideline as a mandatory requirement.
- Why it looks right
- It is a governance document.
- Why it's wrong
- Guidelines are advisory recommendations; standards and policies are mandatory. The document type sets its enforceability.
Clue to watch for The question distinguishes recommended from required.
-
Miscalculate ALE
- What candidates pick
- Report the single loss expectancy as the annual loss expectancy.
- Why it looks right
- Both are loss values.
- Why it's wrong
- ALE equals SLE multiplied by ARO; the single loss must be multiplied by how often it occurs per year.
Clue to watch for The question gives SLE and ARO and asks for annual loss.
-
NDA for service levels
- What candidates pick
- Use a non-disclosure agreement to define a vendor's uptime commitments.
- Why it looks right
- Both are agreements.
- Why it's wrong
- A service level agreement defines service and performance commitments; an NDA protects confidential information.
Clue to watch for The need is to define service or performance levels.
-
Compliance equals secure
- What candidates pick
- Assume meeting compliance requirements means the organization is fully secure.
- Why it looks right
- Compliance involves controls.
- Why it's wrong
- Compliance meets external requirements and overlaps with security but does not guarantee it; a compliant system can still be insecure.
Clue to watch for The question separates meeting requirements from actual security.
Answer framework
For any Domain 5 scenario, use these steps to find the answer Security+ expects.
- Identify whether the need is governance, risk management, third-party risk, compliance, audits, or awareness.
- For governance, choose the document by specificity and enforceability: policy, standard, procedure or guideline, and assign the right role.
- For risk, follow the process and choose transfer, accept, avoid or mitigate, computing ALE as SLE times ARO where quantitative analysis is needed.
- For third parties, assess vendor and supply chain risk and choose the correct agreement type for the need.
- For compliance, audits and awareness, meet the requirements, choose the right audit or assessment, and run an ongoing, monitored awareness program. Where two options seem to fit, pick the one that most precisely matches the scenario's requirement.
Practice question
Want more like this? The Security+ practice test has questions for every domain.
Checklist
0 of 10
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Technically focused candidates often underprepare for this domain, so give it deliberate attention, since at 20% it is heavily weighted and SY0-701 emphasizes governance, risk and compliance. Start with the governance document hierarchy, drilling the policy-standard-procedure-guideline distinction and the roles, which are commonly tested.
Give special attention to risk management, the distinctive part of this domain: learn the four strategies (transfer, accept, avoid, mitigate) and, crucially, the quantitative calculations, practicing ALE equals SLE times ARO until it is automatic, since calculation questions appear. Then learn third-party agreements (SLA, MOU, MSA, NDA, BPA), compliance requirements and consequences, the audit and penetration testing types, and building an ongoing awareness program.
Because this domain is conceptual and calculation-based rather than hands-on, focused reading, the risk formulas, and scenario practice are the most efficient study. This is the final domain, so finish with full practice tests across all five, and practice the 90-minute pacing.
FAQ
How much of Security+ is Domain 5?
Security Program Management and Oversight is 20% of the exam, reflecting SY0-701's increased emphasis on governance, risk and compliance.
What is the difference between a policy, standard, procedure and guideline?
A policy states high-level intent and is mandatory, a standard defines specific mandatory requirements, a procedure gives step-by-step instructions, and a guideline offers advisory recommendations. They differ in specificity and enforceability.
How do I calculate annualized loss expectancy?
ALE equals the single loss expectancy (SLE), the loss from one event, multiplied by the annualized rate of occurrence (ARO), how many times it is expected per year. For example, a $500,000 loss once every ten years gives an ALE of $50,000.
What are the four risk management strategies?
Transfer (shift the risk to a third party, such as insurance), accept (tolerate it within appetite), avoid (stop the risky activity), and mitigate (reduce its likelihood or impact with controls).
What is the difference between an SLA and an NDA?
A service level agreement defines the service and performance levels a vendor commits to. A non-disclosure agreement protects confidential information shared between parties. They serve different purposes.
Does being compliant mean being secure?
No. Compliance means meeting external legal, regulatory or contractual requirements, which overlaps with security but does not guarantee it. A compliant system can still have security weaknesses.
How does Domain 5 connect to the rest of the exam?
Governance and risk management frame how the security concepts, threat defenses, architecture and operations of the other domains are directed, prioritized and held accountable across the organization.
Other Networking certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 5 knowledge
You have covered governance, risk management, third-party risk, compliance, audits and awareness. Test whether you can apply security program management, including risk calculations, under exam conditions.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the Security+ AI tutor Get any concept explained your way