Security+ SY0-701 Security Program Management
Table of Contents
Click Here to Return To the CompTIA Security+ Course Page
Security Program Management and Oversight is 20% of the CompTIA Security+ (SY0-701) exam. This module covers governance, risk, third-party management, compliance, and awareness. This is the managerial side of security that ties technical controls to business goals.
The technical domains protect systems. This domain answers why and how an organization decides what to protect, how much risk it accepts, and who is accountable.
Security Governance
Governance sets the direction and the rules.
| Document | Purpose |
|---|---|
| Policy | High-level intent (acceptable use) |
| Standard | Mandatory rules (AES-256 for data) |
| Procedure | Step-by-step instructions |
| Guideline | Recommended best practice |
Governance structures include boards, committees, and centralized vs. decentralized models. Define data roles clearly: the data owner sets classification, the data custodian maintains it, and the data processor handles it on the owner’s behalf.
Risk Management
You identify, assess, and treat risk on a repeating cycle.
- Identification finds threats and vulnerabilities.
- Assessment can be qualitative (high/medium/low) or quantitative (dollar values).
- Analysis measures likelihood and impact, often on a risk matrix.
- A risk register tracks each risk, its owner, and its status.
Quantitative analysis uses three formulas:
| Term | Formula | Meaning |
|---|---|---|
| SLE | Asset Value × EF | Loss from one event |
| ARO | Rate | Times per year an event occurs |
| ALE | SLE × ARO | Expected yearly loss |
You then choose a risk strategy:
- Mitigate reduces the risk with controls.
- Transfer allocates some financial impact through a contract or insurance. The organization keeps accountability and uncovered impact.
- Accept keeps the risk when cost outweighs benefit.
- Avoid stops the activity that creates the risk.
Compare control cost with expected loss, legal duties, safety needs, and operational impact before deciding.
Third-Party Risk Management
Vendors extend your attack surface, so you vet them.
- Assess with vendor questionnaires, right-to-audit clauses, and independent assessments.
- Watch the supply chain for tampered hardware or compromised software.
Know the agreement types:
| Agreement | Purpose |
|---|---|
| SLA | Service performance targets |
| MOU/MOA | Intent to work together |
| MSA | Master terms for ongoing work |
| SOW | Specific deliverables and scope |
| NDA | Protects confidential information |
| BPA | Terms between business partners |
Compliance and Privacy
Compliance work evaluates whether defined activities meet specified requirements within an assessed scope and time period. An audit result does not prove that every system is secure or will remain compliant.
- Regulatory duties have legal force where applicable, such as GDPR and HIPAA. PCI DSS is an industry standard mainly enforced through payment contracts and card-brand or acquirer programs. Check the obligations that apply to your organization.
- Non-compliance brings fines, sanctions, and reputational damage.
- Data privacy covers data sovereignty (laws of where data lives), classification, retention, and legal holds.
Compare popular privacy tools in best privacy browsers .
Frameworks and Standards
Frameworks give you a proven structure instead of starting from scratch.
| Framework | Focus |
|---|---|
| NIST CSF 2.0 | Govern, Identify, Protect, Detect, Respond, Recover |
| ISO 27001 | Information security management system |
| SOC 2 | AICPA examination and report on controls relevant to selected Trust Services Criteria |
| PCI DSS | Cardholder data protection |
Audits and Assessments
You verify that controls work.
- Internal audits are run by staff for self-assessment.
- External audits bring independent third parties for attestation.
- Penetration tests can be offensive, defensive, or integrated, run as known, unknown, or partially known environments.
Security Awareness
People need clear reporting paths and training which matches their work.
- Run phishing campaigns to train and measure user response.
- Teach anomalous behavior recognition so users report odd activity.
- Track metrics such as simulation click rate and report rate alongside observed behavior, reporting quality, and follow-up. A single rate does not establish program effectiveness.
Business Continuity and Disaster Recovery
You plan to keep the business running through disruption.
- A Business Impact Analysis (BIA) ranks critical functions.
- RTO is how fast you must recover, and RPO is how much data loss you can accept.
- Tabletop exercises rehearse the plan without touching production.
Practice: Make a Risk Decision
Harbor Library estimates a ransomware event would affect a records service valued at $40,000. For this fictional exercise, the exposure factor is 0.25 and the annual rate of occurrence is 0.2. Compute single loss expectancy: $40,000 × 0.25 = $10,000. Compute annual loss expectancy: $10,000 × 0.2 = $2,000. These are planning estimates, not a forecast. Test a low and high assumption, then record the range. A $3,000 annual control is not automatically wrong or right because safety, legal duties, and other harms also matter.
Create this risk-register row, then update the missing fields:
| Risk | Evidence | Owner | Treatment | Due | Residual risk | Verification |
|---|---|---|---|---|---|---|
| Export service lacks a tested restore | Last backup exists, no restore record | Library IT lead | Test isolated restore and restrict backup write role | Set a date | Document after test | Restore log and access test |
Add one vendor question: who can access the backup, how is access logged, and how long does the vendor retain copies? Record the source and date of the answer. For a business impact analysis, identify the critical service and its users. Use the previous lesson’s fictional RTO of 8 hours and RPO of 24 hours. Explain which restore evidence checks each target.
Write a policy statement, a mandatory standard, a step-by-step procedure, and an optional guideline for the export workflow. For audit evidence, name the owner, control, scope, test date, result, and exception. For awareness, run a tabletop with synthetic phishing messages and measure both reporting rate and quality of reports. Do not send simulated phishing to real staff without authorization.
Pass when your register records a decision owner, assumptions and uncertainty, vendor evidence, a measured recovery test, and an exception or follow-up for any failed control. NIST CSF 2.0 includes governance. PCI SSC defines PCI DSS as an industry standard for payment account data; determine applicability from the actual payment environment rather than assuming it covers every library system. Match your study notes to the CompTIA SY0-701 objectives .
Worked governance package and score key
A completed risk-register entry reads: R-04, member-export restore failure, owner Library IT lead, evidence no recorded test, likelihood estimate 0.2 per year, single loss estimate $10,000, annual estimate $2,000, treatment test isolated restore and restrict backup write access, due 2026-11-01, residual risk pending test, status open. At 0.1 events per year, the annual estimate is $1,000; at 0.4 it is $4,000. These values are fictional and highly uncertain. They do not establish the correct control budget by themselves.
| Artifact | Filled example |
|---|---|
| BIA | Records service supports staff access. RTO 8 hours, RPO 24 hours. Owner Records lead. |
| Vendor question | Who reads backup objects and which logs prove access? Vendor answer: not obtained. Follow-up owner: Library IT lead. |
| Policy | Member exports need an approved purpose and restricted audience. |
| Standard | Only the records role may export named records. |
| Procedure | Request, approve, export count-only when sufficient, log, review, delete on schedule. |
| Guideline | Use an approved template for the count-only report. |
| Audit record | Control backup restore; scope Harbor Library; test date pending; result unrun; exception open. |
| Awareness tabletop | Five synthetic messages reviewed. Four were reported, three reports included useful evidence. No real staff campaign occurred. |
The tabletop reporting rate is 4/5 and the useful-report rate is 3/5 in this fictional exercise. A small sample does not estimate an organization’s security culture. Do not invent a vendor answer or a restore result to complete the table. Assign follow-up and leave the status open.
Award one point each for correct SLE/ALE and sensitivity math, decision owner and due date, vendor question and honest answer state, BIA tied to a test, policy/standard/procedure distinction, and audit plus awareness evidence. Pass at 6 of 6 for the written package. A real recovery sign-off requires the actual restore record.
Next Steps
You have now covered all five SY0-701 domains. Revisit Security Operations , Security Architecture , and General Security Concepts as needed, then take the CompTIA Security+ Practice Test and review tips for passing CompTIA exams . Return to the CompTIA Security+ Course .
