Domain 5 — Governance, Risk, and Compliance

Week of 2026-11-24 · Download .docx

Objectives

Apply the risk formula (likelihood × impact) and select the appropriate risk response for a given scenario.
Map the NIST CSF five functions to security controls and explain their relationship.
Distinguish HIPAA, PCI-DSS, SOC 2, and ISO 27001 by applicability and requirements.
Explain DLP, data classification, risk appetite, BIA, RTO, and RPO.
Explain why compliance is necessary but insufficient for security.

Key terms

risk: Risk = Likelihood × Impact — the expected loss from a threat exploiting a vulnerability.
risk appetite: The level of risk an organization is willing to accept in pursuit of business objectives — a board-level policy decision.
risk mitigation: Applying a control to reduce the likelihood or impact of a risk — the most common response for high-probability risks.
risk transfer: Shifting the financial impact of a risk to a third party — typically via cyber liability insurance.
risk avoidance: Eliminating the risk entirely by stopping the risky activity — appropriate only for unacceptable high-impact risks.
NIST CSF: NIST Cybersecurity Framework — Identify, Protect, Detect, Respond, Recover — widely adopted baseline for all sectors.
HIPAA: Health Insurance Portability and Accountability Act — U.S. law protecting PHI (Protected Health Information).
PCI-DSS: Payment Card Industry Data Security Standard — required for any organization storing, processing, or transmitting cardholder data.
SOC 2: AICPA audit framework for cloud service providers — evaluates Trust Service Criteria (Security, Availability, Confidentiality, Integrity, Privacy).
DLP: Data Loss Prevention — tools and policies that detect and block unauthorized exfiltration of classified data.
BIA: Business Impact Analysis — identifies critical processes and quantifies the impact of their disruption; inputs to BCP/DR planning.
RTO: Recovery Time Objective — maximum acceptable downtime after a failure.
RPO: Recovery Point Objective — maximum acceptable data loss; determines backup frequency.

The concept

RISK MANAGEMENT FUNDAMENTALS

Risk is the potential for loss from a threat exploiting a vulnerability, quantified as Risk = Likelihood × Impact. Organizations respond to risk in four ways: Mitigate (apply a control to reduce likelihood or impact — the most common response), Accept (document the risk and tolerate it — appropriate when mitigation cost exceeds expected loss), Transfer (shift the financial impact to a third party via cyber insurance — appropriate for high-impact, low-frequency events), and Avoid (stop the risky activity entirely — appropriate for risks with unacceptable impact). Risk appetite is a board-level policy expressing how much risk the organization is willing to accept in pursuit of objectives. It guides all downstream risk decisions: a hospital accepting near-zero risk for patient data sets very different security standards than a startup accepting higher risk to move fast.

NIST CYBERSECURITY FRAMEWORK

The NIST CSF organizes cybersecurity activities into five functions that form a continuous cycle: Identify (understand the organization's assets, risks, and environment), Protect (implement safeguards — access control, training, data security, endpoint protection), Detect (monitor for cybersecurity events — SIEM, anomaly detection), Respond (contain and eradicate detected incidents — incident response plan), and Recover (restore operations and improve based on lessons learned). The NIST CSF is not a compliance framework — it is a risk management tool. It does not certify organizations but provides a common language for discussing cybersecurity posture with executives and regulators. A Business Impact Analysis (BIA) identifies which processes are most critical and what the organization can tolerate — outputs are RTO (how long can we be down?) and RPO (how much data can we lose?). These objectives drive backup strategy and DR site choices.

COMPLIANCE FRAMEWORKS

Compliance establishes minimum legal and industry requirements — it is the floor, not the ceiling. HIPAA protects PHI (Protected Health Information) for healthcare covered entities and their business associates — technical, administrative, and physical safeguards are required. PCI-DSS applies to any organization storing, processing, or transmitting payment cardholder data, regardless of size — the 12 requirements cover network security, encryption, access control, and monitoring. SOC 2 is the AICPA audit standard for cloud service providers and technology companies handling customer data — it evaluates Trust Service Criteria: Security (required), Availability, Processing Integrity, Confidentiality, and Privacy (optional). ISO 27001 is an international ISMS (Information Security Management System) standard requiring organizations to identify risks, implement controls, and continuously improve. An organization can meet all compliance requirements and still be breached — compliance proves minimum controls exist, not that all risks are managed.

DATA GOVERNANCE AND DLP

Data classification assigns sensitivity levels — public, internal, confidential, restricted (or government equivalents: unclassified, secret, top secret). DLP (Data Loss Prevention) tools enforce classification policies by monitoring data in use (endpoints), data in motion (network), and data at rest (storage) — detecting and blocking unauthorized exfiltration via email, USB, cloud upload, or web transfer. Risk registers document known risks with likelihood, impact, risk score, response, and owner. Regular risk register reviews ensure the organization's risk posture reflects the current threat landscape.

Standards alignment: CompTIA Security+ SY0-701 Domain 5.1 (Governance, Risk, and Compliance); Maryland Blueprint College and Career Readiness — Technology and Engineering.

Worked examples

Example 1: A hospital's risk committee reviews: 'Employees emailing PHI to personal accounts for convenience — likelihood 4/5, impact 5/5, risk score 20/25.' The committee evaluates responses: Accepting (score is too high — unacceptable under HIPAA risk tolerance), Transferring (insurance does not prevent the HIPAA violation), Avoiding (employees must still share PHI to do their jobs — avoidance is not feasible). They choose Mitigation: deploy DLP to block PHI from leaving via personal email, require a secure health information exchange platform, and add annual HIPAA training. The residual risk score drops to 1/5 × 5/5 = 5/25 — within the hospital's risk appetite.

Example 2: A SaaS company pursuing SOC 2 Type II certification maps its current controls to the NIST CSF. Identify: asset inventory and risk assessment complete. Protect: access control (RBAC + MFA), encryption at rest and in transit, security training in place. Detect: SIEM deployed, log retention 12 months. Respond: IR plan documented and tested (tabletop exercise completed). Recover: BCP with RTO=4 hours, RPO=1 hour validated through quarterly DR drills. The auditor reviews 12 months of operating effectiveness evidence — a SOC 2 Type II report covers controls operating effectively over time, not just a point-in-time snapshot like SOC 2 Type I.

Common mistakes

Confusing risk transfer (insurance — shifts financial impact) with risk mitigation (controls — reduces likelihood or impact) — both are valid strategies for different risk profiles.
Treating compliance as equivalent to security — an organization can pass all PCI-DSS audits and still be breached by an unpatched zero-day or a social engineering attack that compliance does not address.
Confusing RTO (maximum downtime tolerable) with RPO (maximum data loss tolerable) — RTO answers 'how long can we be down?'; RPO answers 'how old can our backup be?'
Assuming PCI-DSS only applies to banks — any organization touching cardholder data (a small retailer, a school collecting registration fees) must comply.
Using DLP only for insider threat scenarios — DLP also blocks external attackers using legitimate channels (email, cloud upload) to exfiltrate data they accessed through a compromised account.

Self-check

Try each question before reading the answer. Answers at the bottom of this page.

1. Risk = Likelihood × Impact. A risk with high likelihood and low impact should be:

Transferred immediately via insurance
Avoided by stopping the activity
Escalated to the CEO
Mitigated or accepted based on cost-benefit analysis

2. HIPAA requires protection of:

All corporate financial data
Employee records
PHI — Protected Health Information
Only billing records

3. SOC 2 compliance is relevant for:

Only government contractors
Banks and financial institutions only
Organizations processing health data
Service providers handling customer data

4. DLP tools prevent:

Malware execution
Network intrusion
Unauthorized exfiltration of sensitive data via email, USB, or web uploads
Only insider threats

5. Regulatory compliance means:

Being fully secure from all threats
Meeting minimum legal and industry requirements — the floor, not the security ceiling
Having no known vulnerabilities
Passing a penetration test

Self-check answers

1. D — A moderate risk score (high likelihood × low impact) warrants mitigation or acceptance — transfer and avoidance are disproportionate responses.
2. C — HIPAA protects PHI — any individually identifiable health information in any format. Covered entities and business associates must implement technical, administrative, and physical safeguards.
3. D — SOC 2 is the AICPA audit standard for cloud service providers and technology companies that handle customer data — evaluating Trust Service Criteria.
4. C — DLP monitors data in use, in motion, and at rest — blocking unauthorized exfiltration through all channels regardless of whether the source is insider or external.
5. B — Compliance establishes minimum requirements. An organization can pass all audits and still be breached by threats that compliance controls do not address.

Canvas is the official record. This companion enhances the PGCC curriculum; it does not replace it. Last name and class year only. Students with a 504 plan or IEP: your accommodations apply.

↑ Back to top