Security governance and policy frameworks are the rulebooks and oversight systems that organisations use to protect their computer systems and data. They matter for the CAS-005 exam because the exam will test your ability to match a business need, like protecting customer credit card numbers, to the correct policy, framework or compliance strategy.
Jump to a section
A simple way to picture Security Governance and Policy Frameworks
A rental property is a structured system of rules, agreements and oversight designed to ensure the property is safe, legal and used responsibly.
Before a new tenant moves in, the landlord and property manager create a formal contract, or lease. The lease outlines the rules: no smoking inside, no subletting without permission, and a requirement to mow the lawn every two weeks. This lease is the equivalent of a security policy, a written set of rules for how the property must be treated to protect both the owner's asset and the tenant's rights.
Next, the property manager establishes procedures for enforcing the lease. A monthly inspection checklist ensures the smoke alarms work, the plumbing has no leaks and the lawn is maintained. This checklist is the control framework, a systematic way of checking that the rules are being followed. If the tenant fails to mow the lawn, the manager sends a written warning, which is an enforcement action, similar to how an IT team might issue a security audit finding.
Finally, the property manager keeps records of all inspections, warnings and maintenance requests to prove to the local housing authority that the property meets safety standards. This record-keeping is compliance reporting, evidence that the rules were actually followed. Without this inspection system, the property could fall into disrepair, risk fines from the council, or even cause harm to the tenant. The same goes for a company's digital systems, without governance and policy frameworks, data can be stolen, the company can be fined and systems can fail.
Imagine you are in charge of a large office building and you have to make sure no unauthorised person gets inside, that every employee follows safety rules, and that you can prove to the city council that you are meeting fire and safety laws. That is essentially the job of security governance and policy frameworks in IT, at the level of an entire organisation.
Let us break down the key terms.
Security governance is the overall system of direction, oversight and accountability for an organisation's security. It is not just about technology, it is about who makes decisions, how those decisions are communicated, and how the organisation ensures those decisions are carried out. Governance is the high-level strategy, set by the board of directors and senior executives.
A policy framework is a structured set of documents that defines the rules. The top-level document is the security policy, a high-level statement from leadership that says, for example, 'We will protect customer data in accordance with all applicable laws.' Below that are standards, which are mandatory requirements like 'All passwords must be at least 12 characters long.' Then come procedures, which are step-by-step instructions, such as 'How to reset a forgotten password.' Finally, there are guidelines, which are suggested best practices.
A compliance strategy is the plan to ensure the organisation meets all external legal and regulatory requirements. For example, if a company handles credit card payments, it must follow the Payment Card Industry Data Security Standard (PCI DSS). If it handles health data in the US, it must follow HIPAA. Compliance is not optional, it is enforced by fines and legal penalties.
The reason these frameworks exist is that without them, every department might do security differently, creating gaps that attackers can exploit. For instance, the marketing team might use a shared password on a social media account while the engineering team uses multi-factor authentication, leaving the company exposed. A good framework unifies everyone under the same rules.
Key components of a policy framework include:
Risk assessment: The process of identifying what could go wrong (e.g., a data breach) and how likely it is.
Control selection: Choosing the safeguards (like firewalls or encryption) to reduce those risks.
Policy documentation: Writing the actual policy documents that everyone must follow.
Training and awareness: Teaching employees what the policies are and why they matter.
Monitoring and auditing: Regularly checking that policies are being followed.
Enforcement and remediation: Taking action when policies are violated, and fixing the issue.
Frameworks like ISO 27001 and NIST Cybersecurity Framework provide pre-built templates that organisations can use rather than starting from scratch. ISO 27001 is an international standard that specifies how to build an Information Security Management System (ISMS), which is a systematic approach to managing sensitive information. NIST CSF, developed by the US National Institute of Standards and Technology, uses five core functions: Identify, Protect, Detect, Respond and Recover. These help organisations talk about security in a common language.
In summary, security governance gives direction, policy frameworks provide the rules, and compliance ensures the organisation meets its legal obligations. Together, they form the foundation on which all other security controls are built.
Define the Business Context
The organisation identifies what it does, what data it handles (e.g., customer payment info, health records), and what laws apply (e.g., GDPR, HIPAA). This step sets the scope for all governance activities and determines which frameworks are relevant.
Conduct a Risk Assessment
The organisation identifies potential threats, like ransomware or insider data theft, and evaluates how likely they are and how much damage they could cause. This assessment determines which risks need immediate controls and which the organisation is willing to accept based on its risk appetite.
Develop and Approve Policies
Based on the risk assessment and legal requirements, the organisation writes high-level security policies (e.g., data classification policy, acceptable use policy). These are formally approved by senior leadership or the board to give them authority and bind the entire organisation.
Implement Controls and Procedures
The IT team translates policies into technical controls (e.g., firewalls, encryption, access control) and writes detailed procedures so everyone knows exactly how to configure and use those controls. This step ensures the policy is not just paper, but is actually enforced.
Monitor and Audit Compliance
The organisation uses automated tools and manual reviews to check that controls are working and policies are being followed. Regular audits, both internal and external (for compliance), identify gaps and provide evidence that the organisation is meeting its obligations.
Review and Improve
At least annually, or after a major incident, the organisation reviews the entire governance programme. Policy documents are updated, new risks are assessed and lessons learned from audits are incorporated. This step ensures the framework stays current and effective.
Meet Priya, a newly hired IT Security Analyst at a mid-sized e-commerce company called ShopFast. ShopFast sells children's toys online and stores customer names, addresses and credit card numbers. The company has been growing fast and now has 200 employees. Priya's first task is to ensure the company can pass a PCI DSS audit, which is the standard for handling credit card data.
Here is what Priya actually does step by step:
First, she reviews the existing security policy. She finds that the company has a one-page document that says 'We protect customer data.' That is too vague. Priya drafts a new, detailed security policy that includes a data classification section, which defines what counts as 'sensitive' (customer credit card numbers) versus 'internal' (office lunch schedules). She also writes a password policy requiring 12-character passwords and multi-factor authentication for all administrative accounts.
Next, she works with the IT manager to implement technical controls. She configures the firewall to block all inbound traffic except for the web server, uses encryption (TLS 1.3) to protect data in transit, and implements access controls using the principle of least privilege, meaning employees only get access to the data they absolutely need to do their job. She uses role-based access control (RBAC) to assign permissions, so the warehouse team cannot see customer payment data.
Then, Priya creates a compliance checklist based on the PCI DSS requirements. She uses the checklist during a quarterly internal audit to check that:
All default passwords on servers and network devices have been changed.
Cardholder data is encrypted when stored.
Security patches are applied within 30 days of release.
Access logs are reviewed weekly.
When she finds that the marketing team has a shared spreadsheet with customer email addresses, she reports this as a non-compliance issue. She schedules a training session to explain why storing customer emails in unencrypted spreadsheets violates both company policy and PCI DSS rules. She also provides a secure alternative, a cloud-based CRM with field-level encryption.
Finally, she prepares documentation for the external auditor. She organises evidence such as firewall configuration backups, access control lists and training attendance records. The auditor passes ShopFast with a 'compliant' rating, which allows the company to continue accepting credit card payments without fines.
Priya also sets up a recurring quarterly risk assessment process where she and the IT manager review new threats, like a new phishing campaign targeting e-commerce companies, and update the policies and controls accordingly. This ongoing cycle of assessment, improvement and documentation is the essence of security governance in practice.
The CAS-005 exam objective 1.1 is 'Given a business requirement, implement governance and compliance strategies to manage risk.' This means the exam will present you with a scenario describing a company's need, like 'a hospital needs to protect patient records' or 'a multinational company must comply with GDPR for European customers.' Your job is to select the correct framework, policy or compliance action from a list of options.
Here is what CAS-005 specifically tests within this chapter:
The difference between a policy, a standard, a procedure and a guideline. Expect a question that gives a description, like 'A mandatory rule requiring all laptops to use full-disk encryption,' and asks you to classify it. The correct answer is 'standard', because it is a mandatory requirement. A procedure would be the step-by-step instructions to enable that encryption.
Which framework to apply in which scenario. If the scenario mentions 'international organisation' or 'ISMS', the answer is ISO 27001. If it mentions 'US federal government' or 'cybersecurity risk management', the answer is NIST CSF. If it mentions 'healthcare' in the US, the answer is HIPAA. If it mentions 'credit card data', the answer is PCI DSS.
The difference between governance and management. Governance is about setting direction and oversight (done by the board and senior leaders). Management is about implementing and operating controls (done by IT managers and staff). A common trap question describes a manager configuring a firewall and asks 'Is this governance?' The answer is no, it is operational management.
Risk management terms: risk assessment, risk appetite (how much risk the organisation is willing to accept), risk treatment (deciding to accept, mitigate, transfer or avoid a risk).
Compliance versus audit. Compliance means following the rules. Audit is the formal inspection to verify compliance. A typical question might mix these up, saying 'The auditor found a violation and issued a fine', but auditors do not issue fines, regulators do.
The three lines of defence model: operational management (first line), risk and compliance functions (second line), and internal audit (third line). This is a governance structure for how responsibilities are divided.
Key definitions to memorise:
Policy: High-level statement of intent from management.
Standard: Mandatory requirement, often technical.
Procedure: Specific step-by-step instructions.
Guideline: Suggested best practice, not mandatory.
Baseline: A minimum set of controls that must be in place.
The exam loves to test these distinctions with 'which of the following is the BEST description of a procedure?' type questions. The trap is often that a 'procedure' and 'guideline' sound similar in casual language, but in SecurityX they have very specific meanings. A procedure is mandatory (you must do it exactly this way), whereas a guideline is optional advice.
A security policy is a high-level statement of intent, whereas a standard is a mandatory technical requirement.
The NIST Cybersecurity Framework's five core functions are Identify, Protect, Detect, Respond and Recover.
Risk appetite is the amount of risk an organisation is willing to accept, and it must be set by senior leadership before controls are chosen.
Compliance means meeting legal or contractual requirements, but it does not guarantee full security against novel attacks.
The three lines of defence model separates operational management, risk and compliance oversight, and independent internal audit.
A procedure is a mandatory step-by-step instruction, not a suggestion, unlike a guideline which is optional advice.
These come up on the exam all the time. Here's how to tell them apart.
Policy
High-level statement of management intent
Focuses on 'what' and 'why'
Often one to three pages long
Standard
Mandatory, specific technical requirement
Focuses on 'how' and 'how much'
Can be detailed and technical, e.g., key length
ISO 27001
International standard for an ISMS
Requires third-party certification
Organised by clauses and control sets
NIST Cybersecurity Framework
US-developed, voluntary framework
Focuses on cybersecurity risk management
Organised by five functions: Identify, Protect, Detect, Respond, Recover
Compliance
The state of following rules and laws
Is a goal or outcome, not an activity
Achieved through ongoing processes
Audit
A formal inspection to verify compliance
Is a specific activity, often periodic
Produces a report of findings
Governance
Sets direction and strategy (the 'what')
Done by board and senior executives
Provides oversight and accountability
Management
Implements and operates controls (the 'how')
Done by IT managers and staff
Focuses on day-to-day security operations
Mistake
Security policies are only for large corporations with big budgets. Small businesses do not need them.
Correct
Every organisation, regardless of size, needs at least a basic security policy to define rules and protect data. Even a freelancer with one client should have a policy on how they handle client files.
Beginners often think compliance and governance are 'big company problems' and that startups can just 'be careful'. But data breaches happen to small businesses too, and many clients now require proof of a security policy before signing a contract.
Mistake
Once a policy is written and approved, the work is done. You just file it away.
Correct
A policy is a living document that must be reviewed and updated at least annually, or whenever major changes occur, like adopting a new cloud service or hiring remote workers.
Many people, including non-IT managers, view policy writing as a one-time checkbox exercise. They do not realise that threats, laws and business operations change, so the policy must evolve to stay effective.
Mistake
Compliance and security are the same thing. If you are compliant, you are secure.
Correct
Compliance means meeting minimum legal or contractual requirements. A company can be fully compliant with PCI DSS but still be hacked if it does not address other risks, like insider threats or zero-day vulnerabilities.
The exam industry often talks about 'compliance frameworks', so beginners assume that ticking all the boxes makes them safe. In reality, security is broader, and attackers do not care if you are technically compliant.
Mistake
A policy, a standard, and a procedure are all the same thing, just different names for rules.
Correct
They are distinct levels of documentation. A policy sets the high-level goal ('we will protect customer data'). A standard specifies the mandatory technical requirement ('use AES-256 encryption'). A procedure gives step-by-step instructions on how to implement that encryption.
These terms are used loosely in everyday conversation, so it feels natural to treat them as synonyms. The CAS-005 exam specifically tests the precise technical definitions, so this blurring causes errors.
Mistake
The IT department is solely responsible for security governance and policies.
Correct
Security governance is a board-level and executive responsibility. The board sets the risk appetite and signs off on policies. IT implements the technical controls, but the accountability sits at the top.
In practice, IT teams often drive security initiatives, so beginners think they have full ownership. However, without executive buy-in, policies lack authority and funding, so governance frameworks explicitly place responsibility on senior leadership.
Mistake
If a company uses a cloud provider like AWS, the provider handles all security governance and compliance for the customer.
Correct
Cloud providers follow a shared responsibility model. The provider is responsible for the security OF the cloud (the physical data centre, the hypervisor). The customer is responsible for security IN the cloud (their data, their access controls, their configurations).
Beginners hear 'the cloud is secure' and assume it absolves them of work. They do not realise that the customer must still write policies for their own data, implement IAM roles and configure encryption in AWS, all of which fall under governance.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
A security policy is a high-level statement of management intent, like 'We will protect customer data.' A security standard is a mandatory rule or specification, like 'All passwords must be at least 12 characters long.' Policies set the goal, standards define the specific requirement.
No, you only need to know the purpose of key frameworks: ISO 27001 for international ISMS, NIST CSF for cybersecurity risk management, PCI DSS for credit card data, and HIPAA for US healthcare data. The exam will give you a scenario and you must pick the correct framework for that situation.
Risk appetite is how much risk the organisation is willing to accept to achieve its goals. For example, a bank has a very low risk appetite because losing customer money would destroy its reputation, while a startup might accept higher risks to launch a product quickly.
The board of directors and senior executives hold ultimate responsibility for security governance. They set the risk appetite and approve policies. IT managers and staff then implement the controls, but the accountability resides at the top.
It is a governance model that divides security responsibilities. The first line is operational management (the people who do the work), the second line is risk and compliance oversight, and the third line is independent internal audit. This prevents conflicts of interest and ensures proper oversight.
No, a guideline is a suggested best practice that is not mandatory. A standard, however, is a mandatory requirement. For example, a standard might say 'use AES-256 encryption', while a guideline might say 'consider using additional logging for high-risk systems.'
You've finished Security Governance and Policy Frameworks. Continue through the CAS-005 study guide to build a complete picture of the exam.
Done with this chapter?