CompTIA Security+ Security Program Management and Oversight Syllabus

Security Program Management and Oversight syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Security Program Management and Oversight in CompTIA Security+, not a summary of it.

1. 1

   Security Governance

   5 topics

   • Guidelines, Policies, and Standards
     • Acceptable use policy (AUP)
     • Information security and business continuity policies
     • Password, access control, and encryption standards
   • Procedures
     • Change management and onboarding/offboarding
     • Playbooks
   • Governance Structures
     • Boards, committees, government entities
     • Centralized vs decentralized governance
   • Roles and Responsibilities
     • Owners and controllers
     • Processors and custodians/stewards
   • External Considerations
     • Regulatory, legal, industry, and geographic
     • Local/regional, national, global
2. 2

   Risk Management

   5 topics

   • Risk Identification and Assessment
     • Risk assessment types: ad hoc, recurring, one-time, continuous
     • Risk register, key risk indicators, risk owners, risk threshold
   • Risk Analysis
     • Qualitative and quantitative
     • SLE, ALE, ARO
     • Probability, likelihood, exposure factor, impact
   • Risk Tolerance and Appetite
     • Expansionary, conservative, neutral appetite
   • Risk Management Strategies
     • Transfer and accept (exemption/exception)
     • Avoid and mitigate
   • Business Impact Analysis
     • RTO and RPO
     • MTTR and MTBF
3. 3

   Third-Party Risk Management

   4 topics

   • Vendor Assessment
     • Penetration testing and right-to-audit clause
     • Independent assessments and supply chain analysis
   • Vendor Selection
     • Due diligence and conflict of interest
   • Agreement Types
     • SLA, MOA, MOU
     • MSA, SOW, NDA, BPA
   • Vendor Monitoring and Questionnaires
4. 4

   Security Compliance and Audits

   5 topics

   • Compliance Reporting
     • Internal and external reporting
   • Consequences of Non-Compliance
     • Fines and sanctions
     • Reputational damage and loss of license
   • Compliance Monitoring
     • Due diligence/care and attestation
     • Internal and external monitoring, automation
   • Privacy
     • Legal implications: local/regional, national, global
     • Data subject, controller, processor
     • Right to be forgotten
   • Audits and Assessments
     • Internal: compliance, audit committee, self-assessment
     • External: regulatory, examinations, attestation
     • Penetration testing: known/partially known/unknown environment
5. 5

   Security Awareness

   4 topics

   • Phishing Awareness
     • Campaigns and recognizing phishing attempts
     • Responding to suspicious messages
   • Anomalous Behavior Recognition
     • Risky, unexpected, and unintentional behavior
   • User Guidance and Training
     • Policy/handbooks and situational awareness
     • Insider threat, password management, social engineering
     • Operational security and remote/hybrid work
   • Awareness Program Development and Execution
     • Reporting and monitoring
     • Development and execution

Security Program Management and Oversight flashcards for CompTIA Security+

22 of 71 cards from the Security Program Management and Oversight deck — real questions with worked answers.

1. What is the difference between a policy, a standard, a procedure, and a guideline in a security governance hierarchy?

   Policy = high-level management statement of intent (the 'why/what', mandatory). Standard = specific mandatory requirements that enforce a policy (the 'what', e.g., AES-256). Procedure = step-by-step instructions to implement (the 'how', mandatory). Guideline = recommended, non-mandatory best practices.

2. What is an Acceptable Use Policy (AUP)?

   A document that defines the permitted and prohibited uses of an organization's systems, networks, and data by employees, contractors, and other users.

3. In security governance, why are standards considered mandatory while guidelines are not?

   Standards specify uniform, enforceable requirements that ensure consistency and compliance with policy, so they must be followed. Guidelines are discretionary recommendations that offer flexibility on how to act when no rigid rule applies.

4. Name common security policy types tested on Security+ that govern personnel and operations.

   Acceptable Use Policy (AUP), Information Security Policy, Business Continuity Policy, Disaster Recovery Policy, Incident Response Policy, Software Development Lifecycle (SDLC) Policy, and Change Management Policy.

5. What is the purpose of a change management procedure in security operations?

   To control modifications to systems in a structured way—approval, testing, documentation, and rollback planning—so changes don't introduce vulnerabilities, outages, or unauthorized configurations.

6. What is an onboarding versus offboarding procedure?

   Onboarding = provisioning new users with accounts, access, equipment, and policy acknowledgment. Offboarding = revoking access, recovering assets, disabling accounts, and conducting exit processes when a user leaves.

7. What is a governance structure, and what are the main types?

   The framework defining how security decisions are made and who is accountable. Types include boards, committees, government entities, and centralized vs. decentralized governance.

8. Compare centralized and decentralized governance structures.

   Centralized governance concentrates decision-making in one authority/team, giving consistency and tighter control. Decentralized governance distributes decision-making across units/regions, giving flexibility and local responsiveness but less uniformity.

9. What is the role of a board of directors versus a committee in security governance?

   A board provides top-level oversight, sets strategic direction, and is ultimately accountable. A committee is a smaller specialized group that focuses on specific areas (e.g., risk or audit) and reports to the board.

10. In data governance, what does a data owner do versus a data custodian?

    The data owner is a senior/business role accountable for classifying data and approving access. The data custodian (typically IT) handles technical protection—storage, backups, access enforcement, and maintenance—on the owner's behalf.

11. What is the role of a data processor versus a data controller under privacy frameworks?

    The data controller determines the purposes and means of processing personal data (decides why/how). The data processor processes data on behalf of and under the instructions of the controller.

12. What is a Data Protection Officer (DPO)?

    A designated role responsible for overseeing an organization's data protection strategy and ensuring compliance with privacy regulations such as the GDPR.

13. What are 'external considerations' that influence a security governance program?

    Regulatory, legal, industry, and geographic/jurisdictional factors—laws and regulations, national/territory/local requirements, and industry-specific standards—that an organization must account for when designing its program.

14. What is the difference between regulatory and contractual compliance obligations?

    Regulatory compliance is mandated by laws/regulations (e.g., HIPAA, GDPR) with legal penalties. Contractual compliance arises from agreements with other parties (e.g., PCI DSS, SLAs) and is enforced through the contract terms.

15. What are the four primary steps/phases of the risk management process?

    1) Risk identification, 2) Risk assessment/analysis, 3) Risk response/treatment, and 4) Risk monitoring and review (ongoing).

16. What is risk identification?

    The process of discovering and documenting potential threats, vulnerabilities, and risks that could affect organizational assets, before they can be assessed and treated.

17. Differentiate qualitative and quantitative risk analysis.

    Qualitative analysis uses subjective ratings (e.g., low/medium/high, probability x impact matrices) without precise dollar values. Quantitative analysis uses numeric/monetary values and formulas (SLE, ARO, ALE) to calculate expected loss.

18. Define SLE, ARO, and ALE and give the formula linking them.

    SLE (Single Loss Expectancy) = cost of one occurrence. ARO (Annualized Rate of Occurrence) = expected occurrences per year. ALE (Annualized Loss Expectancy) = SLE x ARO.

19. How is Single Loss Expectancy (SLE) calculated?

    SLE = Asset Value (AV) x Exposure Factor (EF), where EF is the percentage of asset value lost in a single incident.

20. Calculate ALE: an asset worth $50,000 has a 20% exposure factor and the event occurs twice per year.

    SLE = $50,000 x 0.20 = $10,000. ALE = SLE x ARO = $10,000 x 2 = $20,000 per year.

21. What is the Exposure Factor (EF) in quantitative risk analysis?

    The percentage of an asset's value that would be lost if a specific threat materialized (expressed as a decimal in the SLE formula).

22. What is the difference between risk appetite and risk tolerance?

    Risk appetite is the broad amount/type of risk an organization is willing to pursue or accept to meet its objectives. Risk tolerance is the acceptable variation/deviation around that appetite for a specific risk.

See more Security Program Management and Oversight flashcards →

Planning Security Program Management and Oversight for CompTIA Security+

Security Program Management and Oversight (CompTIA Security+) FAQ