Policies, Standards, BIA, Risk Register, and Treatment

Introduction

This lesson opens Domain 5, Security Program Management and Oversight (20% of SY0-701). It covers objective 5.1, summarizing elements of effective security governance, and objective 5.2, explaining the elements of the risk management process. Technical controls only work when an organization decides what to protect, who is accountable, which rules apply, and how much risk it will accept. The exam rewards candidates who think like a manager: link controls to business impact, choose a sensible treatment for a risk, and know the document or role responsible for each decision.