SY0-701 · Objective 5.1 · Security Program Management and Oversight
5.1 Security governance explained
The official objective: “Summarize elements of effective security governance.” Here is what it means, what candidates mix up, and 3 practice questions that test it.
What objective 5.1 covers
Objective 5.1 is about how an organisation directs and controls its security programme. The exam expects you to tell the governance documents apart and to match each data role to its responsibility.
The documents form a hierarchy. A policy states management's intent and high-level rules: what must happen and why. A standard sets specific, mandatory requirements that support a policy, such as 'all data at rest must be encrypted with AES-256'. A procedure gives the step-by-step instructions for carrying out a task, and a playbook is a procedure for a specific situation, such as responding to a phishing report. A guideline is a recommendation: helpful advice that isn't mandatory.
The objective names the policies you should recognise: acceptable use, information security, business continuity, disaster recovery, incident response, software development lifecycle and change management. Standards include passwords, access control, physical security and encryption. Procedures include change management, onboarding and offboarding, and playbooks.
External considerations shape all of this: regulatory, legal, industry-specific, local or regional, national and global requirements. A company operating in several US states, for example, has to follow each state's breach notification rules.
Governance needs ongoing monitoring and revision. Documents should be reviewed on a schedule and whenever laws, technology or the business change.
Governance structures describe who makes the decisions. Boards and committees oversee security at the top. Government entities set rules for regulated sectors. A centralised structure makes decisions in one place, which gives consistency. A decentralised structure lets business units or regions make their own decisions within a common policy, which gives flexibility but makes consistency harder.
Roles and responsibilities for systems and data finish the objective. The owner is accountable for the data, decides its classification and who may access it. The controller decides why and how personal data is processed. The processor handles personal data on the controller's behalf and only under its instructions. The custodian, often IT, looks after the data day to day: backups, storage and applying the access the owner approved. The steward manages data quality and correct use according to the owner's rules.
Most questions here are definitional. Read for the key word: mandatory specifics is a standard, step by step is a procedure, recommended is a guideline, intent is a policy.
What candidates mix up
- Policy versus standard: a policy states intent; a standard sets specific mandatory requirements.
- Procedure versus guideline: a procedure must be followed step by step; a guideline is optional advice.
- Owner versus custodian: the owner is accountable and decides; the custodian carries out day-to-day care.
- Controller versus processor: the controller decides why and how personal data is used; the processor acts on its instructions.
Practice questions for 5.1
From the CertRidge SY0-701 question bank. Try each one before opening the answer.
Question 1
In an organization's security documentation hierarchy, which statement correctly distinguishes a policy from a procedure?
- AA policy states management's mandatory, high-level intent; a procedure gives step-by-step instructions for a task
- BA policy lists recommended but optional practices; a procedure sets the mandatory configuration values to use
- CA policy specifies exact technical settings and baselines; a procedure records management's overall security goals
- DA policy is approved by IT staff and revised often; a procedure is approved by the board and rarely changes
Show answer and explanation
Answer: A) A policy states management's mandatory, high-level intent; a procedure gives step-by-step instructions for a task
Policies are mandatory, high-level statements of management intent, and procedures are the detailed step-by-step instructions that carry them out. Standards set mandatory specifics, and guidelines offer optional recommendations.
- ACorrect. Policies are management-approved, mandatory statements of intent and direction that change relatively rarely. Procedures describe exactly how to carry out a task in line with policy and are updated more often.
- BIncorrect. Optional, recommended practices describe guidelines, and mandatory specific values (such as minimum key lengths) describe standards. Policies are mandatory.
- CIncorrect. This reverses the roles and confuses a policy with a standard. Exact settings belong in standards or baselines, management intent belongs in policy, and procedures contain the how-to steps.
- DIncorrect. Senior management approves policies, which are relatively stable. Procedures are operational documents that are maintained by the teams that do the work and change more often.
Question 2
A multinational sets security policy at headquarters but lets each regional office choose and run its own controls, as long as they meet the policy. Which governance structure is this?
- ADecentralized
- BCentralized
- CAir-gapped
- DFederated identity
Show answer and explanation
Answer: A) Decentralized
- ADecentralized governance gives regions or units authority over their own implementation within an overall framework.
- BCentralized governance keeps decisions and implementation at headquarters.
- CAir-gapping describes network isolation, not governance.
- DFederated identity concerns cross-organization sign-in.
Question 3
Which best describes the role of a data owner versus a data custodian?
- AThe data owner (a business role) is accountable for classification and access decisions; the custodian (often IT) implements and maintains the controls
- BThey are the same person by definition
- CThe custodian decides who may access the data
- DThe owner physically racks the storage hardware
Show answer and explanation
Answer: A) The data owner (a business role) is accountable for classification and access decisions; the custodian (often IT) implements and maintains the controls
- AOwnership carries accountability for the data's protection requirements; custodianship carries responsibility for day-to-day safeguarding per those requirements.
- BThe roles are deliberately separated for accountability.
- CAccess authorization decisions belong to the owner; the custodian enforces them.
- DThat is an operational task, not the accountable ownership role.
Other Security Program Management and Oversight objectives
Also: the Security Program Management and Oversight domain page (20% of the exam), all SY0-701 objectives and the SY0-701 cheat sheet.
Ready for a full SY0-701 practice exam?
Timed practice exams match the real exam's length and domain weights, every result shows your score per domain, and Review Mode re-drills the questions you missed.
Objective numbers and statements from CompTIA's published SY0-701 exam objectives. The explanations and questions are our own. Not affiliated with CompTIA.