Domain 1 · Objective reference 1.3 · Chapter 3 of 62
Governance, business alignment and assurance
About 5 minutes · Current ISC2 outline effective 15 April 2024; the announced 15 April 2027 replacement requires separate mapping
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: Governance directs; management implements; assurance evaluates.
Explore the anchors
Align security with business objectives.
Concept matching activity
Match this task or description to its concept:
Assign risk decisions and resources.
Choose a concept before checking the explanation.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Concepts and mechanisms
- Design, evidence and tradeoffs
- Choose frameworks for the decision
Concepts and mechanisms
Governance sets direction, authority and oversight; management organizes execution. Security should support the organization’s mission and fit its corporate investment and risk routes. Roles such as information owner, service owner, risk owner, operator and assurance provider have different decisions to make. Frameworks organize requirements or outcomes, but an ISMS, a control guide and a threat-technique catalog are not interchangeable forms of assurance.
Design, evidence and tradeoffs
Link a business objective to a risk scenario, desired outcome, funded initiative, owner and evidence of benefit. Consider acquisitions, divestitures and shared services because they change ownership and dependencies. A control operator may identify exposure without holding acceptance authority. Due diligence and due care require both informed evaluation and appropriate action. A scoped certificate is evidence to evaluate, not proof that every system is secure.
Choose frameworks for the decision
COBIT emphasizes governance and management of enterprise information and technology; SABSA organizes business-driven security architecture. NIST and ISO publications serve different risk, control and management-system purposes. PCI requirements concern the payment-card environment, while FedRAMP concerns authorization of cloud services for the US federal context. Compare applicability, scope and evidence needs before selecting a framework. During an acquisition, investigate inherited identities, obligations and supplier dependencies before deciding how systems will be integrated. Due diligence is the inquiry; due care includes acting prudently on what it reveals.
Worked example
A group acquisition changes identity and supplier dependencies, prompting a strategy review before continuing the former control assumptions.
Check your understanding
Why should a security strategy not be a product list?
Show explanation
Products do not by themselves specify business outcomes, accountable decisions, operating capacity or evidence that the intended benefit occurred.
Source and study boundary
Official syllabus source. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.