CompTIA Security+ Security Program Management and Oversight Syllabus

What is the Exposure Factor (EF) in quantitative risk analysis?

The percentage of an asset's value that would be lost if a specific threat materialized (expressed as a decimal in the SLE formula).

What is the difference between risk appetite and risk tolerance?

Risk appetite is the broad amount/type of risk an organization is willing to pursue or accept to meet its objectives. Risk tolerance is the acceptable variation/deviation around that appetite for a specific risk.

Name the three risk appetite postures organizations may adopt.

Expansionary (willing to take greater risk for greater reward), Conservative (minimizing risk, prioritizing safety/stability), and Neutral (balanced, moderate approach).

List the four primary risk management (treatment) strategies.

Risk acceptance, risk avoidance, risk mitigation (reduction), and risk transference (sharing, e.g., insurance).

What is risk transference, and give an example?

Shifting the financial impact of a risk to a third party. Example: purchasing cybersecurity insurance or outsourcing a function so the provider bears the risk.

What is risk avoidance versus risk mitigation?

Risk avoidance eliminates the risk entirely by not engaging in the risky activity. Risk mitigation reduces the likelihood or impact of a risk using controls but does not eliminate it.

What is residual risk?

The risk that remains after security controls and mitigation measures have been applied.

What is risk acceptance, and what is an 'exemption' or 'exception' in that context?

Risk acceptance is choosing to take no action and bear a risk because it falls within tolerance or treatment costs too much. An exception/exemption is a documented, approved decision to deviate from a policy/standard and accept the associated risk.

What is a risk register?

A central document that records identified risks along with their description, likelihood, impact, owner, risk score, and mitigation/treatment plans.

What do 'inherent risk' and 'control risk' mean?

Inherent risk is the level of risk before any controls are applied. Control risk reflects the chance that existing controls fail to prevent or detect a problem.

What is KRI (Key Risk Indicator) and how does it relate to risk reporting?

A KRI is a metric that signals increasing risk exposure (early warning). Risk owners and risk reporting use KRIs to track whether risks are approaching tolerance thresholds.

What is a Business Impact Analysis (BIA)?

A process that identifies critical business functions and analyzes the operational and financial effects of their disruption to prioritize recovery.

Define RTO, RPO, MTD, and MTTR.

RTO (Recovery Time Objective) = max acceptable downtime to restore a function. RPO (Recovery Point Objective) = max acceptable data loss measured in time. MTD (Maximum Tolerable Downtime) = absolute limit a function can be down. MTTR (Mean Time To Repair) = average time to restore a failed component.

What is the difference between MTBF and MTTR?

MTBF (Mean Time Between Failures) measures the average operational time between failures (reliability). MTTR (Mean Time To Repair/Recover) measures the average time required to fix a failed system (maintainability).

How does RPO drive backup strategy?

RPO defines the maximum tolerable data loss in time, so backups must run at least as frequently as the RPO window (e.g., a 1-hour RPO requires backups/replication at least hourly).

What is a vendor/supply chain assessment?

The process of evaluating a third party's security posture, financial stability, reputation, and risk before and during a business relationship, often using audits, questionnaires, and penetration testing.

Differentiate a right-to-audit clause and an independent (third-party) assessment in vendor assessment.

A right-to-audit clause is a contractual provision letting you audit the vendor directly. An independent/third-party assessment relies on an external auditor's report (e.g., SOC 2) to evaluate the vendor's controls.

What factors are considered during vendor selection?

Due diligence (financial health, reputation, security posture) and conflict-of-interest checks to ensure no relationships compromise objectivity or create bias.

What is due diligence versus due care in vendor management?

Due diligence is the investigation/research done before entering a relationship (verifying the vendor is trustworthy). Due care is the ongoing reasonable effort and prudence exercised to protect assets during the relationship.

Define SLA, MOU/MOA, and BPA agreement types.

SLA (Service Level Agreement) = guarantees service performance metrics (uptime, response). MOU/MOA (Memorandum of Understanding/Agreement) = a non-binding/less formal statement of intent between parties. BPA (Business Partners Agreement) = defines responsibilities, profit sharing, and terms between business partners.

What is a Master Service Agreement (MSA) and how does it relate to an SOW?

An MSA is an overarching contract establishing general terms governing the relationship. An SOW (Statement of Work) is a specific document defining the deliverables, scope, timeline, and tasks for a particular project under the MSA.

What is an NDA, and what does an SLA's penalty clause do?

An NDA (Non-Disclosure Agreement) legally binds parties to keep shared confidential information secret. An SLA penalty/remedy clause specifies consequences (e.g., service credits) when the provider fails to meet agreed performance levels.

What is vendor monitoring, and what tools support it?

The ongoing evaluation of a vendor's performance, security posture, and compliance throughout the relationship—supported by questionnaires, performance reviews, security ratings, and audits—not just at onboarding.

What is a vendor questionnaire used for?

A structured set of questions sent to a third party to gather information about its security controls, policies, certifications, and risk posture as part of assessment and ongoing monitoring.

What is the difference between internal and external compliance reporting?

Internal reporting communicates compliance status to management/board within the organization to support decisions. External reporting provides compliance information to regulators, auditors, partners, or the public to demonstrate adherence.

List common consequences of non-compliance.

Fines, sanctions, reputational damage, loss of license, contractual impacts (loss of business/contracts), and potential legal/criminal liability.

What is continuous compliance monitoring, and why is it preferred over point-in-time checks?

Ongoing, often automated, verification that controls and configurations remain compliant. It is preferred because it detects drift and violations in near real time, rather than only at scheduled audit intervals.

What is attestation in the context of compliance?

A formal declaration or acknowledgment—often signed by management or a third party—affirming that controls are in place and the organization meets specific compliance requirements.

What are common legal implications/scopes of compliance: local, national, and global?

Compliance obligations vary by jurisdiction—local (city/state), national (country-wide laws), and global/international (cross-border regulations like GDPR)—and organizations must satisfy all applicable layers where they operate.

What is the difference between data inventory and data retention in a privacy program?

Data inventory catalogs what personal/sensitive data is held, where it lives, and how it flows. Data retention defines how long data is kept and when it must be securely disposed of, per policy and law.

What is the 'right to be forgotten'?

A privacy right (notably under GDPR) allowing individuals to request that an organization delete their personal data when there is no compelling reason to keep it.

Differentiate the roles of data subject, data owner, and data controller in privacy.

Data subject = the individual whom the personal data is about. Data owner = internal party accountable for the data's classification/protection. Data controller = the entity that decides the purposes and means of processing the data.

What is the difference between an internal audit and an external audit?

An internal audit is performed by the organization's own staff to evaluate controls and readiness. An external audit is conducted by an independent third party, providing impartial verification and credibility (e.g., regulatory or certification audits).

What is the difference between an audit, an assessment, and a penetration test?

An audit verifies compliance against a defined standard/control set. An assessment broadly evaluates security posture and gaps. A penetration test actively exploits vulnerabilities to demonstrate real-world impact.

What is attestation versus examination in independent assessments?

In an attestation engagement, an auditor reports on management's own assertion about controls. In an examination, the auditor independently tests and forms an opinion on the controls/subject matter directly.

What is phishing, and how does it differ from spear phishing and whaling?

Phishing = mass fraudulent messages to trick users into revealing data or clicking malicious links. Spear phishing = targeted at a specific individual/group. Whaling = spear phishing aimed at high-value executives (the 'big fish').

Differentiate phishing, vishing, smishing, and pharming.

Phishing = fraudulent email. Vishing = voice/phone-based. Smishing = SMS/text-based. Pharming = redirecting users to a fake site (e.g., via DNS poisoning) without requiring them to click a link.

What are common indicators that help users recognize a phishing message?

Urgent or threatening language, requests for credentials/payment, generic greetings, mismatched or spoofed sender addresses, suspicious links/attachments, spelling/grammar errors, and unexpected requests that bypass normal process.

What is anomalous behavior recognition in user security awareness?

Training users and systems to detect deviations from normal patterns—risky behavior, unexpected actions, or unintentional behavior—that may indicate compromise or insider threat.

Classify the three types of anomalous behavior emphasized in Security+ user guidance.

Risky behavior (knowingly dangerous actions), unexpected behavior (out-of-pattern activity), and unintentional behavior (accidental mistakes such as misdirected email or accidental data exposure).

What topics should comprehensive user guidance and security awareness training cover?

Policies/handbooks, situational awareness, insider threat, password management, removable media/cables, social engineering, operational security, and hybrid/remote work practices.

What is operational security (OPSEC) guidance for users?

Teaching users to protect sensitive information by limiting what details (about systems, projects, or routines) they disclose, since seemingly harmless data can be aggregated by adversaries for attacks.

What is an insider threat, and what user guidance reduces it?

A security risk originating from people inside the organization (employees, contractors). Guidance includes least-privilege access, monitoring, reporting suspicious behavior, and clear acceptable-use and data-handling policies.

What are the key phases of developing and executing a security awareness program?

Develop (design content and objectives), Execute (deliver training/campaigns), Review/measure (assess effectiveness via metrics like phishing click rates), and continuously improve based on results.

Why is a security awareness program treated as a recurring cycle rather than a one-time event?

Because threats evolve, staff change, and behavior reverts over time; continuous reinforcement, periodic phishing simulations, and metric-driven updates keep users effective against current attacks.

What metrics measure the effectiveness of a phishing awareness/anti-phishing campaign?

Phishing simulation click-through rates, reporting rates (how many users report the test), time-to-report, repeat-offender counts, and trends in these metrics over successive campaigns.

What is the purpose of recognizing and reporting phishing attempts (the 'report' behavior)?

Prompt reporting lets security teams contain threats, warn other users, block malicious senders/links, and improve defenses—turning each user into an active sensor in the human firewall.

What is a gap analysis in the context of audits and assessments?

A comparison of an organization's current security state against a desired standard or framework to identify the differences ('gaps') that must be remediated to reach compliance.

What is the difference between compliance monitoring done internally versus by an external entity?

Internal compliance monitoring uses the organization's own tools/staff for self-assessment and continuous oversight. External monitoring involves regulators or third-party auditors verifying adherence, often required for certifications or legal obligations.

What is supply chain risk, and why is vendor monitoring critical to it?

Supply chain risk is the threat that a compromised vendor, supplier, or service provider introduces vulnerabilities into your environment. Ongoing vendor monitoring is critical because a third party's security posture can degrade after onboarding.

What is the difference between an SLA and an OLA?

An SLA (Service Level Agreement) is between a service provider and an external customer. An OLA (Operational Level Agreement) defines responsibilities between internal teams/departments that support delivery of that SLA.