Exam objective 1.3 asks you to describe security governance, compliance, and the role of policies, standards, and procedures. This topic matters because the CC exam tests whether you understand how an organisation stays safe through rules and accountability, not just through technology. Without governance, security efforts are random and untestable.
Jump to a section
A simple way to picture Security Governance and Compliance
A building inspector works for the city council. Their job is to check that a new office building is constructed according to the city's approved plans, the national building code, and the fire safety regulations. The inspector does not decide which walls should be painted blue or where the reception desk goes. The inspector's job is to enforce the rules that protect everyone who will later use that building. If the wiring is not up to code, the inspector fails that part of the inspection. The building owner must then fix the wiring and pay for a re-inspection.
In IT security, the same logic applies. The 'policies' are like the city's building code. The 'standards' are the specific materials that must be used, like fireproof drywall. The 'procedures' are the step-by-step instructions for installing the wiring correctly. 'Compliance' is the inspection itself. The business wants to pass the inspection, not just for a certificate, but because the rules prevent disasters. The inspector is not the enemy. The inspector is the person who makes sure the building does not collapse during a storm. Security governance is the system that says, 'We will have these rules, we will follow them, and we will prove we follow them.'
Security governance is the framework of rules, roles, and responsibilities that guide how an organisation manages security. Think of it as the 'who decides what' and 'who enforces it' part of security. Governance is not about firewalls or passwords. It is about the system that makes sure firewalls and passwords are used correctly.
A policy is a high-level statement of intent. It says what must be achieved. For example, an 'Acceptable Use Policy' states that company computers may only be used for business purposes. A policy does not say how to achieve that. It just says what the goal is. Policies are written by senior management and are mandatory.
A standard is a specific, measurable requirement. Standards are the 'how good' part of the rule. For example, a standard might say that all company laptops must have disk encryption enabled. That standard makes the policy concrete. Standards are often set by industry bodies or the organisation itself.
A procedure is a step-by-step instruction. It tells someone exactly what to do to comply with a policy and standard. For example, a procedure for laptop encryption might say: 'Step 1: Open system settings. Step 2: Click security. Step 3: Enable BitLocker. Step 4: Verify encryption is active.' Procedures are the most detailed level of guidance.
Compliance is the act of conforming to a rule, standard, or law. In security, compliance often means proving that the organisation meets specific requirements. This could be a legal requirement like GDPR (General Data Protection Regulation) or an industry requirement like PCI DSS (Payment Card Industry Data Security Standard).
Why do we need all this structure? Without it, security is chaotic. One person might lock their computer screen, another might not. One team might update software, another might ignore updates. Policies create uniformity. Standards create a measurable baseline. Procedures create consistency. Compliance creates accountability.
In the CC exam, you need to know the difference between these four terms. A common question gives you a scenario and asks: 'Is this a policy, standard, procedure, or compliance activity?' You must recognise that a policy is a broad rule, a standard is a specific requirement, and a procedure is a how-to guide. Compliance is the act of checking or verifying.
Governance also includes assigning roles. The board of directors owns governance. Senior management enforces it. The security team implements it. Employees follow it. The CC exam may ask who is responsible for what. The answer is usually that management owns governance, not IT.
Another key concept is 'due diligence' and 'due care'. Due diligence means the organisation investigated the risks and made informed decisions. Due care means the organisation acted responsibly based on those decisions. Together, they form 'reasonable care' — the legal standard for avoiding negligence.
Finally, remember that governance is ongoing. It is not a one-time project. It involves continuous monitoring, auditing, and improvement. The CC exam expects you to understand that governance is a cycle: Plan, Do, Check, Act. This is the Deming Cycle, also known as the PDCA cycle.
Define the Governance Scope
Senior management decides which parts of the business the governance framework will cover. This includes all systems, data, and people. Without this scope, rules have no boundaries.
Create the Security Policy
A policy document is written. For example, 'All customer data must be protected from unauthorised access.' This is the 'what' of security governance. The policy is approved by the board and becomes mandatory.
Develop Supporting Standards
For each policy, standards are created. If the policy is about customer data protection, the standard might say: 'All customer databases must be encrypted using AES-256.' Standards make the policy measurable.
Write Detailed Procedures
For each standard, a procedure is written. The encryption procedure would list exact commands or software steps to enable AES-256 on a database. Procedures ensure consistent execution.
Implement Controls and Training
The technical controls (e.g., encryption tools) are deployed. Employees are trained on the policies, standards, and procedures. Training is a governance requirement, not an optional extra.
Monitor and Audit Compliance
Tools log whether controls are applied. Auditors check the logs against the standards. If a database lacks encryption, that is a compliance failure. The organisation must fix it.
Review and Improve Governance
The board reviews compliance reports. They decide whether to update policies based on new risks or regulatory changes. This step closes the PDCA cycle and keeps governance current.
An IT professional working as a security analyst at a mid-sized bank deals with governance and compliance every day. Here is a typical week:
Monday morning, the analyst checks a dashboard that shows compliance status for the company's 500 servers. The dashboard reports that 12 servers are missing the latest security patch. The analyst opens the 'Patch Management Standard' document. That standard states: 'All critical patches must be applied within 72 hours of release.' The patch in question is 96 hours old. This is a non-compliance issue. - The analyst identifies the 12 servers. - The analyst checks the 'Server Patching Procedure' to see the exact steps the server team must follow. - The analyst opens a ticket in the IT service management system, assigning it to the server team with a priority of 'high'. - The analyst emails the team lead, referencing the policy title ('Patch Management Policy') and the standard (72-hour deadline).
On Wednesday, the patching is complete. The analyst runs a verification scan. All 12 servers now show the patch installed. The analyst updates the compliance dashboard and closes the ticket.
On Thursday, the quarterly audit begins. An external auditor asks to see evidence that the bank complies with the 'Data Encryption Standard'. The analyst provides a report from the encryption management tool showing that all laptops have disk encryption enabled. The auditor also asks for the 'Encryption Key Management Procedure' to verify that keys are stored securely. The analyst provides the procedure document. The auditor checks the logs to ensure the procedure was followed. This is compliance evidence.
On Friday, the analyst attends a governance meeting. The security manager presents a report: 'Overall compliance is at 97%. The remaining 3% is due to three legacy systems that cannot run the required encryption standard. A risk exception request has been submitted.' The board discusses whether to accept the risk or replace the legacy systems. This is governance in action: the decision-makers are weighing risk versus cost.
In this scenario, the IT professional did not invent the policies. They enforced them. They did not create the standards. They applied them. They did not write the procedures. They followed them. They collected evidence of compliance. They reported to governance. This is the daily reality of security governance and compliance work. The CC exam wants you to understand this flow, not memorise every standard name.
The CC exam tests your ability to distinguish between policy, standard, procedure, and compliance. About 3 to 5 questions on the exam will touch on governance and compliance. The exam does not ask you to memorise specific laws like GDPR in detail. It asks you to recognise the concepts.
Question types include:
Scenario-based: 'A company requires all employees to change passwords every 90 days. The document that states this is a...' Answer: Policy.
Classification: 'Which of the following is an example of a security standard?' Answer: 'All servers must use AES-256 encryption.'
Role-based: 'Who is ultimately responsible for security governance in an organisation?' Answer: The board of directors or senior management.
Compliance: 'An auditor checks whether systems meet regulatory requirements. This is an example of...' Answer: Compliance assessment.
Traps the exam sets:
They give you a procedure and call it a policy. Remember: procedures are step-by-step. Policies are high-level statements.
They say 'standard' when they mean 'policy'. For example: 'Employees must use strong passwords.' That is a policy, not a standard, because it does not specify what 'strong' means.
They ask 'who implements governance?' Wrong answer: the IT team. Correct answer: senior management or board.
They confuse 'compliance' with 'security'. Compliance does not equal security. An organisation can be compliant but still insecure. The exam may test this nuance.
Key concepts to memorise:
Policy: high-level, mandatory, 'what'.
Standard: specific, measurable, 'how much'.
Procedure: step-by-step, actionable, 'how'.
Compliance: verification against a rule.
Governance: the overall system of rules and roles.
Due diligence: investigating risks before making decisions.
Due care: taking action to mitigate identified risks.
PDCA cycle: Plan, Do, Check, Act.
The exam loves the term 'regulatory compliance'. Know that this means following laws like GDPR, HIPAA, or PCI DSS. The exam does not require you to know specifics of each law, just that they exist and that organisations must comply.
Finally, remember that a 'risk assessment' often feeds into governance. The exam may link security governance to risk management. The correct answer pattern is: governance sets the direction, risk assessment informs the decisions, compliance verifies the outcome.
Policies are high-level mandatory statements of intent; they say 'what' must be achieved, not 'how'.
Standards turn policies into measurable requirements, such as 'passwords must be at least 12 characters.'
Procedures are the step-by-step instructions that tell people exactly how to comply with a standard.
Compliance is the process of verifying that an organisation's actions match its policies, standards, and legal obligations.
Security governance is the overall system that assigns roles, responsibilities, and accountability for security decisions.
The PDCA cycle (Plan, Do, Check, Act) is the continuous improvement model that underpins governance.
Due diligence means investigating risks before acting; due care means taking responsible action to mitigate those risks.
The board of directors, not the IT team, is ultimately responsible for security governance.
These come up on the exam all the time. Here's how to tell them apart.
Policy
High-level statement of intent
Answers 'what' must be achieved
Example: 'Passwords must be strong.'
Procedure
Step-by-step instructions
Answers 'how' to achieve it
Example: 'Open Settings, click Accounts, select Sign-in options, change password.'
Standard
A specific measurable requirement
Example: 'Password must be at least 12 characters.'
Part of the rule system itself
Compliance
The act of verifying a rule is met
Example: 'Auditor checks password lengths.'
A process of checking against rules
Due Diligence
Investigating risks before a decision
Example: 'Researching a vendor's security before signing a contract.'
Happens before action is taken
Due Care
Taking responsible action after risks are known
Example: 'Implementing controls to fix identified vendor risks.'
Happens after risks are identified
Security Governance
Sets overall direction and accountability
Owned by board and senior management
Focuses on 'what should we do?'
Security Management
Implements and operates controls daily
Owned by security managers and IT
Focuses on 'how do we do it?'
Mistake
An IT security policy is the same as a security procedure.
Correct
A policy states what must be done. A procedure describes how to do it step by step.
Beginner study materials often use the terms interchangeably, and the CC exam specifically tests the difference.
Mistake
Compliance means the organisation is secure.
Correct
Compliance means meeting specific rules. An organisation can be compliant but still have security gaps that the rules do not cover.
People assume that passing an audit equals perfect security, but compliance is only one layer of a defence-in-depth strategy.
Mistake
Standards are optional guidelines.
Correct
Standards are mandatory requirements that must be met to achieve a policy goal. They are not suggestions.
The word 'standard' sounds like 'industry best practice', which is often voluntary, but in a governance context, standards are enforceable.
Mistake
Security governance is the IT department's responsibility alone.
Correct
Security governance is owned by senior management and the board of directors. The IT department implements it.
Beginners hear 'security' and assume it is purely technical. The exam tests that governance is a business leadership responsibility.
Mistake
A policy must include technical details like encryption algorithms.
Correct
A policy is high-level. Technical details belong in standards and procedures.
Learners see example policies that reference technical controls and assume that is normal. The CC exam expects clean separation of levels.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
No. A policy is a high-level statement of intent, like 'we will protect customer data.' A standard is a specific measurable requirement, like 'we will use AES-256 encryption.'
Senior management and the board of directors are ultimately responsible. They set the policies and ensure resources are allocated. The IT team implements the technical controls.
Compliance means meeting a specific rule or law. Security means protecting assets from threats. You can be compliant (e.g., all passwords changed every 90 days) but still insecure (e.g., no multi-factor authentication).
No. You need to know that regulations exist and that organisations must comply. The exam does not test specific regulation details. Focus on the concepts of policy, standard, procedure, and compliance.
Technically yes, but the CC exam tests the distinction. Policies should be high-level. Procedures are separate documents. Mixing them is considered bad governance practice.
A compliance audit is an independent review that checks whether an organisation's actions match its stated policies and applicable laws. Auditors look for evidence like logs, reports, and signed documents.
You've finished Security Governance and Compliance. Continue through the CC study guide to build a complete picture of the exam.
Done with this chapter?