Domain 5: Security Program Management and Oversight
This domain covers the business side of security: who decides, how risk is measured and handled, how vendors are checked, which rules apply, and how you build good habits across an organization. It’s about 20% of SY0-701.
What changes in V8 for this domain: Weight drops to about 14%. CompTIA's V8 summary lists the same six themes: governance, risk, third parties, compliance and privacy, audits, and awareness.
Governance
- Policy: the high-level rule (for example, “sensitive data must be encrypted”).
- Standard: the required specifics (which algorithms are approved).
- Procedure: the step-by-step instructions (how to turn encryption on).
- Guideline: recommended, but not required.
Governance also defines who owns what (data owners, custodians), how often documents are reviewed, and how exceptions are handled.
Risk management
Risk is likelihood × impact. You can avoid, mitigate, transfer (for example, with insurance), or accept a risk. Record decisions in a risk register, with an owner for each risk. Risk appetite is how much risk leadership is willing to take on.
Quick math:
- SLE (single loss expectancy) = asset value × exposure factor
- ALE (annualized loss expectancy) = SLE × ARO (annualized rate of occurrence)
So a $20,000 loss expected every other year (ARO 0.5) gives an ALE of $10,000. These are estimates, not forecasts. A business impact analysis (BIA) identifies what’s critical and how long it can be down.
Third-party risk
A vendor’s security becomes part of yours. Do due diligence before signing, and keep checking afterward. Useful contract terms include SLAs (service targets), NDAs (confidentiality), right to audit, breach-notification timelines, and an exit plan that covers how data is returned or destroyed.
Compliance and privacy
Being compliant isn’t the same as being secure. Know which rules actually apply to you:
- PCI DSS if you handle payment cards.
- HIPAA for covered US health information.
- GDPR for personal data of people in the EU, within its scope.
Data minimization (collect only what you need) and clear retention schedules reduce your exposure.
Audits and assessments
- An audit checks evidence against defined criteria. It can be internal or done by an independent outside party.
- A vulnerability assessment finds and ranks weaknesses.
- A penetration test actually tries to exploit them, with permission.
- Attestation is a formal statement about controls. Every finding needs an owner and a fix-by date.
Security awareness
Training works best when it fits people’s roles and focuses on real behavior: spotting phishing, reporting quickly, and handling data safely. Measure reporting rates and speed, not just course completion. Phishing simulations should teach, not shame.
Key terms
Try to define each term before you tap it.
Policy
High-level mandatory organizational rule
Standard
Mandatory detailed requirement supporting policy
Procedure
Step-by-step instructions for an activity
Guideline
Recommended, generally nonmandatory advice
Risk appetite
Amount and type of risk an organization is willing to pursue or retain
Data owner
Accountable for classification and authorized use of data
SLE
Expected monetary loss from one event
ARO
Expected frequency of an event per year
ALE
Annualized loss expectancy: SLE × ARO
Mitigate
Lower likelihood or impact with controls
Transfer
Shift some financial impact by contract or insurance
Accept
Explicitly retain a risk after informed approval
BIA
Business impact analysis of disruption and recovery priorities
Due diligence
Pre-contract examination of a supplier’s capabilities and risks
SLA
Contractual service-level targets and remedies
NDA
Confidentiality agreement between parties
Right to audit
Contract term allowing defined assurance activities
Supply chain risk
Exposure introduced by upstream vendors and components
Vendor offboarding
Revocation of access and recovery or destruction of data
PCI DSS
Industry security requirements for environments handling payment card data
HIPAA
US legal framework with privacy and security obligations for covered health data
GDPR
EU data-protection regulation with extraterritorial scope in some situations
Data minimization
Collect and retain only needed personal information
Retention schedule
Rules defining how long records must be kept
Regulatory compliance
Conformity to applicable legal and regulatory requirements
Internal audit
Review conducted by an organization’s own independent audit function
External audit
Review performed by an outside independent party
Penetration test
Authorized exercise attempting to demonstrate exploitability
Vulnerability assessment
Identification and ranking of vulnerabilities
Attestation
Formal declaration about controls or compliance
Remediation plan
Assigned corrective actions with deadlines and evidence
Phishing simulation
Controlled test of response to deceptive messages
Tabletop exercise
Discussion-based rehearsal of incident scenarios
Role-based training
Security instruction tailored to job responsibilities
Reporting culture
Environment encouraging quick reporting without unnecessary blame
Social engineering
Manipulating people into unsafe actions or disclosure
Security champion
Team member supporting good security practices locally
Quick self-check
6 practice questions in our own words. Pick an answer to see the explanation. Practice only: it doesn't predict exam results.
Which document usually gives step-by-step instructions for following a policy? Obj. 5.1
Show answer
A. Procedure. Policies set the rule, standards set required specifics, guidelines suggest, and procedures give the steps.
A loss event costs $20,000 each time and is expected 0.5 times per year. What is the ALE? Obj. 5.2
Show answer
B. $10,000. ALE = SLE x ARO = $20,000 x 0.5 = $10,000.
A new supplier will store your employee data. What should happen first? Obj. 5.3
Show answer
A. Security due diligence and contract terms. Assess the vendor and agree on contract terms (notification, right to audit, data handling) before sharing sensitive data.
A company wants to reduce its privacy exposure. Which practice fits best? Obj. 5.4
Show answer
A. Data minimization. Collecting and keeping only the personal data you actually need reduces what can be exposed.
An authorized test actually exploits weaknesses to show what an attacker could do. What is it? Obj. 5.5
Show answer
A. Penetration test. A penetration test tries controlled exploitation. A vulnerability scan only finds and ranks weaknesses.
Besides course completion rates, what best shows a phishing-awareness program is working? Obj. 5.6
Show answer
A. More people reporting suspicious messages, and reporting faster. Behavior is the real measure. More reports, faster, and fewer repeat clicks show the training is changing what people do.
Official exam details, objectives and pricing: CompTIA Security+ (official page) (opens in new tab).
NeonKey isn't affiliated with or endorsed by CompTIA. Security+ is a trademark of CompTIA. No pass guarantees — check CompTIA for current exam details.