Security+ SY0-801 Domain 5: Security Program Management and Oversight

Domain 5 accounts for 14 percent of SY0-801. The questions often look less technical, but they still reward precise distinctions.

Ask four questions:

1. Who owns or approves the decision?
2. Which document or process applies?
3. What evidence supports the conclusion?
4. What happens next?

1. Domain 5 map

2. Governance, risk, and compliance artifacts

Policy, standard, procedure, and guideline

Use purpose, not filename. A document named “password policy” may actually contain technical standards or procedures.

Plans, baselines, benchmarks, and advisories

• Plan: describes intended activities, responsibilities, resources, and timing.
• Baseline: establishes an approved starting or minimum configuration.
• Benchmark: provides a comparison point or recommended configuration set.
• Advisory: communicates risk, a vulnerability, a threat, or recommended action.
• Implementation guide: explains how to put a requirement or architecture into practice.
• Reference architecture: provides a reusable design pattern.
• Runbook: gives operational steps for a recurring task or event.

Vulnerability disclosure and privacy policies

A vulnerability disclosure policy tells external researchers what systems are in scope, which methods are allowed, how findings should be reported, and how the organization will handle good-faith research.

A privacy policy describes how personal data is collected, used, shared, retained, protected, or otherwise handled.

3. Risk management

Risk identification and register

A risk register records identified risks and useful context such as:

• description
• affected assets or objectives
• likelihood
• impact
• owner
• current controls
• treatment
• residual risk
• status
• review date

The risk owner has authority and accountability for the business decision. Security staff may analyze and advise without owning the business risk.

Appetite and tolerance

Risk appetite is the broad amount and type of risk an organization is willing to pursue or retain.

Risk tolerance is the acceptable variation around a specific objective or risk category.

A threshold can trigger escalation or action when a measured condition crosses a defined point.

Inherent, current, and residual risk

• Inherent risk: exposure before controls are considered.
• Current risk: exposure under current conditions and controls.
• Residual risk: risk remaining after a planned or implemented treatment.

Be clear about the point in time described by the scenario.

Qualitative and quantitative analysis

Qualitative methods use categories such as low, medium, and high.

Quantitative methods use numerical estimates.

Common formulas:

• Single loss expectancy (SLE) = asset value × exposure factor
• Annualized loss expectancy (ALE) = SLE × annualized rate of occurrence (ARO)

These estimates support decisions. They do not predict the future with certainty.

Risk treatments

• Mitigate: reduce likelihood or impact.
• Transfer: shift part of the financial or operational consequence.
• Avoid: stop the activity creating the risk.
• Accept: continue with authorized acknowledgement of the remaining risk.

Transfer does not make the underlying outage, legal duty, or reputational harm disappear.

Business impact and reporting

Business impact analysis identifies critical activities, dependencies, and consequences of disruption.

Risk reports should match the audience. Engineers need actionable detail. Leadership needs business exposure, ownership, trend, cost, and decisions requiring approval.

4. Third-party risk

Third parties can introduce access, data, availability, compliance, concentration, and supply-chain risk.

Assessment and selection

Due diligence may review:

• security questionnaires
• architecture and data flow
• independent reports
• incident history
• business continuity
• subcontractors
• financial stability
• data location
• personnel access
• vulnerability management
• exit capability

Vendor selection requests

Service and agreement types

• Service-level agreement (SLA): formal service commitments, often with remedies.
• Service-level objective (SLO): target level of service or reliability.
• Master services agreement (MSA): overall legal and commercial terms for an ongoing relationship.
• Statement of work (SOW): specific work, deliverables, scope, schedule, and acceptance.
• Non-disclosure agreement (NDA): confidentiality obligations.
• Memorandum of understanding (MOU): mutual understanding and responsibilities between parties.

Read the requirement before choosing the acronym.

Vendor registry and monitoring

A vendor registry records approved suppliers, owners, services, criticality, access, contract status, review dates, and other risk information.

Monitoring continues after onboarding. Track:

• service performance
• incidents
• audit reports
• insurance or attestations
• control changes
• vulnerabilities
• subcontractors
• business condition
• compliance status

Compliance attestations and right to audit

An attestation is a formal assertion about controls or compliance. Evaluate its scope, period, independence, exceptions, and relevance.

A right-to-audit clause preserves the customer's ability to obtain evidence or perform review under defined conditions.

Vendor lock-in

Vendor lock-in occurs when switching becomes difficult because of proprietary technology, data formats, contracts, integrations, skills, or migration cost.

Plan exit before dependency becomes critical.

5. Security compliance

Compliance connects requirements to controls, evidence, monitoring, reporting, and remediation.

Sources of requirements

Requirements can come from:

• law
• regulation
• contract
• industry standard
• internal policy
• court or legal order
• customer commitment

The source matters because authority, reporting, evidence, and consequences can differ.

Privacy roles and rights

Common roles include data subject, controller, processor, owner, custodian, and steward.

Privacy rights can include access, correction, deletion or erasure, portability, restriction, or objection, depending on the governing requirement.

Do not treat every request as automatically valid. Applicable exceptions, legal holds, retention duties, identity verification, and jurisdiction matter.

Processing restrictions and retention

Define why data is collected, where it is processed, who receives it, how long it is retained, and how disposal occurs.

A legal hold can suspend normal deletion for records relevant to a legal matter.

Anti-money laundering/counter-terrorism financing (AML/CTF) and anti-bribery

AML/CTF and anti-bribery obligations can require monitoring, reporting, due diligence, recordkeeping, and controls around financial or procurement activity.

For the exam, focus on the security and compliance process rather than memorizing jurisdiction-specific statutes.

6. Audits and assessments

Internal and external audits

An internal audit evaluates controls and governance from within the organization while maintaining appropriate independence from the activity being audited.

An external audit provides independent review for regulators, certifications, customers, investors, or other stakeholders.

Audit charter, scope, and frequency

An audit charter defines authority, responsibility, independence, and access.

Scope identifies what is being examined. Frequency should reflect risk, obligations, change, and oversight requirements.

Evidence and attestation

Useful evidence should be:

• relevant
• complete enough for the conclusion
• attributable
• timely
• protected from improper change

An attestation is a formal assertion. Evidence supports whether the assertion is reasonable.

Gap analysis and benchmarking

A gap analysis compares the current state with a target state.

Benchmarking compares performance or configuration with an internal or external reference.

The output should identify what differs, why it matters, ownership, and action.

Reconnaissance and penetration testing

Reconnaissance gathers information about a target. Passive methods minimize direct interaction. Active methods send queries or traffic.

Penetration testing attempts authorized exploitation under defined rules of engagement.

A scanner identifies possible weaknesses. A penetration test may demonstrate whether an attack path works.

MITRE adversary behavior framework

MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) organizes observed adversary behavior into tactics, techniques, and related information. It helps teams describe how adversaries operate and map detections or controls.

It is not a chronological incident timeline.

Cyber Kill Chain

The Cyber Kill Chain models intrusion activity as stages such as reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives.

Its strength is thinking about where the chain can be disrupted.

Diamond Model

The Diamond Model describes an intrusion event through four core vertices:

• adversary
• capability
• infrastructure
• victim

It helps analysts connect relationships across events and campaigns.

Functional and behavioral testing

Functional testing checks whether a control works as designed. Behavioral testing examines how people, systems, or controls respond under realistic conditions.

The purpose should determine the test design.

7. Security awareness

Awareness should change decisions, not only collect completion records.

Delivery methods

Training can use:

• instructor-led sessions
• computer-based learning
• videos
• simulations
• newsletters
• posters or reminders
• role-based workshops
• exercises
• just-in-time prompts

Choose the method that fits the audience and behavior.

Phishing and social-engineering exercises

Measure more than click rate.

Useful measures include:

• reporting rate
• time to report
• repeated behavior
• correct verification
• help-desk or security contacts
• improvement over time

Avoid incentives that make users hide mistakes.

Behavior risk scoring

A behavior risk score may combine training, phishing, reporting, access, policy, or other indicators.

Use it carefully. Poor data or opaque scoring can create unfair or misleading conclusions. The goal should be targeted support and risk reduction.

Business email compromise

Business email compromise often uses trusted identities and financial workflows rather than malware.

Protect high-impact changes with an independent verification process. A reply to the same message thread is not independent verification.

Passwords, removable media, bring your own device (BYOD), remote work, and operational security (OPSEC)

Awareness should match real work. Cover:

• password and authenticator use
• suspicious messages
• removable devices and cables
• personally owned devices
• remote work
• physical privacy
• data handling
• operational security
• reporting channels

8. Common Domain 5 traps

Picking a document by acronym instead of purpose

Use the need. Pricing points toward RFQ. A proposed solution points toward RFP. A service target points toward SLO or SLA depending on commitment.

Assigning risk acceptance to the security analyst

Security can recommend. The authorized business risk owner accepts.

Treating ATT&CK, Kill Chain, and Diamond Model as interchangeable

ATT&CK catalogs adversary behavior. Kill Chain models stages. Diamond Model connects adversary, capability, infrastructure, and victim.

9. Domain 5 review checklist

Confirm that you can:

• distinguish policy, standard, procedure, guideline, plan, baseline, benchmark, advisory, implementation guide, reference architecture, and runbook
• explain risk register, owner, appetite, tolerance, inherent/current/residual risk, SLE, ARO, ALE, and treatment choices
• choose RFI, RFP, RFQ, EOI, SLA, SLO, MSA, SOW, NDA, and MOU by purpose
• explain vendor registries, attestations, right-to-audit clauses, ongoing monitoring, lock-in, and exit planning
• identify privacy, retention, legal-hold, AML/CTF, and anti-bribery considerations at a process level
• compare internal/external audit, gap analysis, benchmarking, reconnaissance, penetration testing, ATT&CK, Cyber Kill Chain, Diamond Model, functional testing, and behavioral testing
• design awareness activities that measure useful behavior rather than attendance alone

10. Official and primary references

• CompTIA Security+ certification page
• NIST Cybersecurity Framework 2.0
• NIST SP 800-30 Rev. 1: Guide for Conducting Risk Assessments
• NIST SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices
• MITRE ATT&CK
• Lockheed Martin Cyber Kill Chain
• NIST SP 800-115: Technical Guide to Information Security Testing and Assessment
• NIST SP 800-50 Rev. 1: Building a Cybersecurity and Privacy Learning Program