Domain 2 · Security Governance · Lesson 2 of 5
Turn security policy into accountable daily work
About 16 minutes · Introductory draft · Checked 2026-10-22
AI editorial review for introductory study; independent review and complete exam alignment remain pending. Read course scope and remaining gaps.
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
What you will learn
- Distinguish policy, standards and procedures.
- Explain business continuity, recovery and tested backups.
- Choose a useful awareness or risk measure.
Give decisions an owner
Governance sets direction, accountability and oversight. A policy states a required outcome, such as protecting customer records. A standard makes an expectation specific, such as an approved encryption configuration. A procedure explains the steps staff follow. Compliance evidence shows whether an applicable requirement is met; it does not establish that every business risk is controlled.
When an exception is necessary, record its scope, reason, owner, expiry and safeguards. The person responsible for the affected business risk should decide acceptance through the organization’s process. A junior analyst should not silently make an exception permanent.
Plan to continue and recover
Business continuity keeps priority activities operating during disruption, perhaps through a manual process. Disaster recovery restores supporting technology and data. A recovery time objective describes a target restoration time; a recovery point objective describes an acceptable point in time for recovered data. Both are business requirements, not promises made by a backup product.
Redundant equipment can reduce some interruptions, but replication can copy corruption. Keep appropriately protected backups and test restoration, including permissions, dependencies and useful data. For an AI-supported service, record which approved model, configuration and data version are required. A successful file copy is weaker evidence than a demonstrated usable recovery.
Measure behavior and exposure
Awareness should teach an action: verify an unusual payment request through a known contact channel and report suspicious messages. A realistic voice or video can also be fabricated. Do not rely on recognition of a familiar voice as the only approval check.
Count outcomes with context. The number of overdue critical fixes, measured against the total in scope and a defined deadline, is more informative than the number of dashboards. An increase in reported suspicious emails may reflect better reporting rather than worsening security. Review trends, definitions and ownership before drawing conclusions.
Work through a scenario
Fictional facts for learning. This exercise is not scored.
A backup dashboard is green, but nobody has restored the payroll system. Payroll must resume within four hours. What should the team verify?
Compare your reasoning
Run an approved restoration exercise with the system owner. Measure the time to a usable payroll service and inspect the recovered data point, access and dependencies. Compare the result with the agreed targets and assign gaps. A green backup job does not prove the four-hour requirement is met.
Applied study · Added 2026-10-22
Measure resilience and report usable evidence
Continue beyond the introduction. Work through the evidence before opening the model answer.
See it · Try it · Recall it
Picture the topic
Remember this: Governance directs; risk prioritizes; compliance demonstrates.
Explore the anchors
Set direction and decision authority.
Concept matching activity
Match this task or description to its concept:
Evaluate uncertain consequences.
Choose a concept before checking the explanation.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
Visual recap for topic 2.1. Open its full syllabus chapter.
Connect continuity targets to a business service
Business continuity keeps essential activity operating through disruption; disaster recovery restores technology capabilities. A recovery time objective expresses the target time to restore an agreed service, and a recovery point objective expresses tolerable data loss measured in time. These are business decisions, not automatic properties of the backup product. Redundant servers may still share one identity provider, power supply or administrator. Map shared dependencies and test the complete service, including people and manual procedures. A successful backup job is evidence of a completed job, not evidence that the business can meet its recovery target.
Make a metric support a decision
Specify the population, measurement period, data source and action threshold. Training attendance measures participation; observed reporting of suspicious messages measures a different behavior. Do not reward staff for hiding mistakes merely to improve a chart. A risk indicator describes exposure or movement toward a threshold, while a performance measure describes how a process operates. Read both with context. When a simulated exercise misses its target, report the gap and accountable corrective action instead of changing the target retrospectively to label the test successful.
Evidence case
Fictional facts for learning; no real organization or person is described.
- A payroll service has an agreed four-hour recovery target and a two-hour data-loss tolerance.
- A restore test takes five hours; its newest usable backup is six hours old. The backup console reports every job green.
Your task
- Compare the observed results with each target.
- Write a concise issue statement for the service owner.
Compare with the model answer
The observed five-hour restoration misses the four-hour recovery target. The six-hour-old restore point also exceeds the two-hour data-loss tolerance. Green job status does not reverse either result. Record the test scope, timing and backup used, then assign actions for restore speed and backup frequency or replication. Retest the complete payroll workflow. Only the authorized business owner can change an agreed target after evaluating the consequences.
This case has two original scenario questions in the expanded practice bank. Practice this course · Edition, coverage and remaining study
Remember
- Policies need procedures, owners and evidence.
- Continuity and technology recovery support each other.
- A metric needs a definition, denominator, timeframe and action.
Orientation and further reading
Original examples and explanations. Background references do not establish complete exam coverage.