Governance & Policy

Compliance and security effectiveness

Evidence: Mixed

Revision: Available · 1 question · 1 flashcard

Exam relevance

Learning-only · no verified exam mapping

Reviewed revision scope

• Assessment or certification provides scoped assurance, not guaranteed security; the MOT analogy highlights ongoing control effectiveness and review.

• Session 3: Governance, Risk and Compliance — Classroom session record
• Session 4: Governance, Risk and Compliance — In Depth — Classroom session record
• Governance, Risk and Compliance (GRC) — Supplementary Study Guide explanation

Recorded evidence

• Assessment or certification provides scoped assurance, not guaranteed security; the MOT analogy highlights ongoing control effectiveness and review.

• Session 3: Governance, Risk and Compliance — Classroom session record · Governance and Accountability; Risk and Measurement; Risk Management Lifecycle; Risk Treatment; Compliance Is Not the Same as Security; Risk Appetite vs Risk Tolerance; CVSS and Business Risk; ISO/IEC 27001 and 27002; Cyber Essentials; NIST Cybersecurity Framework; UK GDPR and Data Protection; Data Classification; UK GDPR Lawful Bases; ICO and the 72-Hour Rule; PCI DSS
• Session 4: Governance, Risk and Compliance — In Depth — Classroom session record · The Three GRC Pillars; Compliance ≠ Security; ISO/IEC 27001 and Continual Improvement; Why Consultants Need Business Context; Business Impact Analysis; Assessing Risk; Identifying and Managing Risk; Frameworks and Standards; UK GDPR and Data Protection; Data Classification and Handling
• Governance, Risk and Compliance (GRC) — Supplementary Study Guide explanation · Three connected responsibilities; Accountability and organisational roles; Departmental silos, communication and training; Compliance vs security

Reviewed 2026-09-22. Reviewed against approved Sessions 3–4 learning and Core Concepts explanations. Fictional applications are educational elaborations, not completed practical work. Learning-only; this concept has not yet been individually verified against the Security+ SY0-701 objectives or any other exam syllabus.

NIST CSF Functions in Practice

Evidence: Mixed

Revision: Available · 6 questions · 3 flashcards

Exam relevance

Learning-only · no verified exam mapping

Reviewed revision scope

• Classroom (Session 4): NIST CSF 2.0 has six Functions, Govern, Identify, Protect, Detect, Respond and Recover; Govern addresses direction, oversight and risk decisions across the other Functions, and the Functions are related activities, not a rigid one-pass sequence.
• Classroom (Session 7): a framework diagram with five functions, Identify, Protect, Detect, Respond and Recover, was shown, with discussion of internal and external threats, identifying assets and risks, safeguards and protection, detection and monitoring, incident response and recovery.
• Classroom (Session 7): the gap-analysis example listed Identity and Access Management and Data Security under Protect.
• Classroom (Session 3): the five-function sequence Identify, Protect, Detect, Respond and Recover was introduced as a continuous security lifecycle.
• Supplementary: each Function answers a question: Govern, how will we manage cybersecurity; Identify, what do we have and what could go wrong; Protect, how do we reduce the likelihood or impact of harm; Detect, how do we know something suspicious is happening; Respond, what do we do when an incident occurs; Recover, how do we restore operations and improve afterwards.
• Supplementary: the Functions are concurrent and continuous: Govern, Identify, Protect and Detect happen all the time, while Respond and Recover are ready at all times and happen when an incident occurs; the familiar order is a memory aid, not a queue.
• Supplementary: identity and access management belongs primarily under Protect, because managing identities, authentication and permissions are safeguards, although Govern sets the access policy, Detect watches sign-ins and Respond disables a compromised account.
• Supplementary: making a backup is a Protect activity because the copy is a safeguard made in advance, and restoring from it after an incident is a Recover activity.
• Supplementary: the five-function model is the earlier version of the framework, in which governance sat inside Identify; it is not wrong, but CSF 2.0 has six Functions, and Govern did not replace Identify.

• Session 3: Governance, Risk and Compliance — Classroom session record
• Session 4: Governance, Risk and Compliance — In Depth — Classroom session record
• Session 7: Security+ Session 1 — Security Concepts, Controls and Roles — Classroom session record
• The NIST Cybersecurity Framework — Supplementary Study Guide explanation

Recorded evidence

• Classroom (Session 4): NIST CSF 2.0 has six Functions, Govern, Identify, Protect, Detect, Respond and Recover; Govern addresses direction, oversight and risk decisions across the other Functions, and the Functions are related activities, not a rigid one-pass sequence.
• Classroom (Session 7): a framework diagram with five functions, Identify, Protect, Detect, Respond and Recover, was shown, with discussion of internal and external threats, identifying assets and risks, safeguards and protection, detection and monitoring, incident response and recovery.
• Classroom (Session 7): the gap-analysis example listed Identity and Access Management and Data Security under Protect.
• Classroom (Session 3): the five-function sequence Identify, Protect, Detect, Respond and Recover was introduced as a continuous security lifecycle.
• Supplementary: each Function answers a question: Govern, how will we manage cybersecurity; Identify, what do we have and what could go wrong; Protect, how do we reduce the likelihood or impact of harm; Detect, how do we know something suspicious is happening; Respond, what do we do when an incident occurs; Recover, how do we restore operations and improve afterwards.
• Supplementary: the Functions are concurrent and continuous: Govern, Identify, Protect and Detect happen all the time, while Respond and Recover are ready at all times and happen when an incident occurs; the familiar order is a memory aid, not a queue.
• Supplementary: identity and access management belongs primarily under Protect, because managing identities, authentication and permissions are safeguards, although Govern sets the access policy, Detect watches sign-ins and Respond disables a compromised account.
• Supplementary: making a backup is a Protect activity because the copy is a safeguard made in advance, and restoring from it after an incident is a Recover activity.
• Supplementary: the five-function model is the earlier version of the framework, in which governance sat inside Identify; it is not wrong, but CSF 2.0 has six Functions, and Govern did not replace Identify.

• Session 3: Governance, Risk and Compliance — Classroom session record · Governance and Accountability; Risk and Measurement; Risk Management Lifecycle; Risk Treatment; Compliance Is Not the Same as Security; Risk Appetite vs Risk Tolerance; CVSS and Business Risk; ISO/IEC 27001 and 27002; Cyber Essentials; NIST Cybersecurity Framework; UK GDPR and Data Protection; Data Classification; UK GDPR Lawful Bases; ICO and the 72-Hour Rule; PCI DSS
• Session 4: Governance, Risk and Compliance — In Depth — Classroom session record · The Three GRC Pillars; Compliance ≠ Security; ISO/IEC 27001 and Continual Improvement; Why Consultants Need Business Context; Business Impact Analysis; Assessing Risk; Identifying and Managing Risk; Frameworks and Standards; UK GDPR and Data Protection; Data Classification and Handling
• Session 7: Security+ Session 1 — Security Concepts, Controls and Roles — Classroom session record · The CIA triad; Non-repudiation; Security properties at a water-treatment plant; The NIST Cybersecurity Framework; Gap analysis; Identification, authentication, authorisation and accounting; What a security control is; Security control categories; Security control functional types; Information security roles and responsibilities; Due diligence and due care; Information security competencies; Security business units; Administrative (management) controls; Least privilege
• The NIST Cybersecurity Framework — Supplementary Study Guide explanation · What the framework is; The six Functions; One organisation, six Functions; Internal and external threats; Not a one-way lifecycle; Five Functions or six; Where identity and access management fits; Placing an activity in a Function

Reviewed 2026-10-02. Owner review completed on 2 October 2026. Checked during authoring against the Session 7 Learning Log and the The NIST Cybersecurity Framework lesson Sources and scope section. Scope statements are labelled Classroom or Supplementary: Classroom statements record what the session covered, and beginner-first wording developed afterwards is labelled Supplementary. No practical competence, completed assessment or exam alignment is implied.

Due Diligence and Due Care

Evidence: Mixed

Revision: Available · 3 questions · 1 flashcard

Exam relevance

• Security+ · 5.4 · direct

  Mapped on 8 October 2026 for the “Due diligence/care” sub-bullet of compliance monitoring only. Course coverage and authored revision do not establish full objective coverage.

Verified for Security+: 2 of 3 questions and 1 of 1 flashcard. The mapping does not verify the others.

Reviewed revision scope

• Classroom (Session 7): the difference between due diligence and due care was explained.
• Supplementary: due diligence comes first and due care acts on what it finds; in the ransomware example, assessing threats, inspecting vulnerabilities, reviewing backup arrangements and examining current controls are due diligence, while patching, improving backups, deploying MFA and training staff are due care.
• Supplementary: diligence without care is knowing about a problem and doing nothing, and care without diligence is acting without understanding the risks; reasonable action does not mean removing every risk.
• Supplementary: due diligence is investigating, assessing and understanding the risks, and due care is taking reasonable action to address those risks.

• Session 7: Security+ Session 1 — Security Concepts, Controls and Roles — Classroom session record
• Security Roles and Responsibilities — Supplementary Study Guide explanation

Recorded evidence

• Classroom (Session 7): the difference between due diligence and due care was explained.
• Supplementary: due diligence comes first and due care acts on what it finds; in the ransomware example, assessing threats, inspecting vulnerabilities, reviewing backup arrangements and examining current controls are due diligence, while patching, improving backups, deploying MFA and training staff are due care.
• Supplementary: diligence without care is knowing about a problem and doing nothing, and care without diligence is acting without understanding the risks; reasonable action does not mean removing every risk.
• Supplementary: due diligence is investigating, assessing and understanding the risks, and due care is taking reasonable action to address those risks.

• Session 7: Security+ Session 1 — Security Concepts, Controls and Roles — Classroom session record · The CIA triad; Non-repudiation; Security properties at a water-treatment plant; The NIST Cybersecurity Framework; Gap analysis; Identification, authentication, authorisation and accounting; What a security control is; Security control categories; Security control functional types; Information security roles and responsibilities; Due diligence and due care; Information security competencies; Security business units; Administrative (management) controls; Least privilege
• Security Roles and Responsibilities — Supplementary Study Guide explanation · Who is responsible for security; CIO, CISO and CSO; The ISSO: security of particular systems; Titles vary between organisations; Due diligence and due care; An example: ransomware; Why both are needed

Reviewed 2026-10-02. Owner review completed on 2 October 2026. Checked during authoring against the Session 7 Learning Log and the Security Roles and Responsibilities lesson Sources and scope section. Scope statements are labelled Classroom or Supplementary: Classroom statements record what the session covered, and beginner-first wording developed afterwards is labelled Supplementary. No practical competence, completed assessment or exam alignment is implied.

Gap Analysis

Evidence: Mixed

Revision: Available · 5 questions · 2 flashcards

Exam relevance

• Security+ · 1.2 · direct

  Mapped on 8 October 2026 for the “Gap analysis” bullet only; the scoring method taught in the lesson is not part of the objective. Course coverage and authored revision do not establish full objective coverage.

Verified for Security+: 1 of 5 questions and 1 of 2 flashcards. The mapping does not verify the others.

Reviewed revision scope

• Classroom (Session 7): gap analysis was covered, and the scored example gave Identify 10/16 (62.5%), made up of Asset Management 4/6 (66.7%), Governance 3/4 (75%) and Risk Assessment 3/6 (50%), and Protect 8/16 (50%), made up of Identity and Access Management 5/8 (62.5%) and Data Security 3/8 (37.5%).
• Classroom (Session 3): the NIST Cybersecurity Framework was presented as useful for gap assessments, comparing where the organisation is now with where it should be.
• Supplementary: the four steps are to define the target state, assess the current state using evidence, identify the gaps, and plan and prioritise remediation with an owner and a date; gaps can only be listed once both states are known, and the cycle repeats as the organisation and the target change.
• Supplementary: a percentage score is the achieved figure divided by the total; a combined score adds the achieved figures and the totals and does not average the percentages.
• Supplementary: the lowest raw percentage is not automatically the highest-priority risk; priority also depends on business impact, system criticality, likelihood and context, and a score does not show what is missing.
• Supplementary: a gap analysis is a comparison against a target, not an attack or a penetration test, and meeting the whole of a target does not show that an organisation is secure.
• Supplementary: gap analysis compares the current state with the target, or desired, state to identify gaps and then determine improvements or remediation.

• Session 3: Governance, Risk and Compliance — Classroom session record
• Session 7: Security+ Session 1 — Security Concepts, Controls and Roles — Classroom session record
• Gap Analysis — Supplementary Study Guide explanation

Recorded evidence

• Classroom (Session 7): gap analysis was covered, and the scored example gave Identify 10/16 (62.5%), made up of Asset Management 4/6 (66.7%), Governance 3/4 (75%) and Risk Assessment 3/6 (50%), and Protect 8/16 (50%), made up of Identity and Access Management 5/8 (62.5%) and Data Security 3/8 (37.5%).
• Classroom (Session 3): the NIST Cybersecurity Framework was presented as useful for gap assessments, comparing where the organisation is now with where it should be.
• Supplementary: the four steps are to define the target state, assess the current state using evidence, identify the gaps, and plan and prioritise remediation with an owner and a date; gaps can only be listed once both states are known, and the cycle repeats as the organisation and the target change.
• Supplementary: a percentage score is the achieved figure divided by the total; a combined score adds the achieved figures and the totals and does not average the percentages.
• Supplementary: the lowest raw percentage is not automatically the highest-priority risk; priority also depends on business impact, system criticality, likelihood and context, and a score does not show what is missing.
• Supplementary: a gap analysis is a comparison against a target, not an attack or a penetration test, and meeting the whole of a target does not show that an organisation is secure.
• Supplementary: gap analysis compares the current state with the target, or desired, state to identify gaps and then determine improvements or remediation.

• Session 3: Governance, Risk and Compliance — Classroom session record · Governance and Accountability; Risk and Measurement; Risk Management Lifecycle; Risk Treatment; Compliance Is Not the Same as Security; Risk Appetite vs Risk Tolerance; CVSS and Business Risk; ISO/IEC 27001 and 27002; Cyber Essentials; NIST Cybersecurity Framework; UK GDPR and Data Protection; Data Classification; UK GDPR Lawful Bases; ICO and the 72-Hour Rule; PCI DSS
• Session 7: Security+ Session 1 — Security Concepts, Controls and Roles — Classroom session record · The CIA triad; Non-repudiation; Security properties at a water-treatment plant; The NIST Cybersecurity Framework; Gap analysis; Identification, authentication, authorisation and accounting; What a security control is; Security control categories; Security control functional types; Information security roles and responsibilities; Due diligence and due care; Information security competencies; Security business units; Administrative (management) controls; Least privilege
• Gap Analysis — Supplementary Study Guide explanation · The idea; Four steps; A worked example: scoring against a framework; How the scores are calculated; Reading the scores; Prioritise by risk, not by percentage; From gaps to a remediation plan; Gap analysis and the NIST framework

Reviewed 2026-10-02. Owner review completed on 2 October 2026. Checked during authoring against the Session 7 Learning Log and the Gap Analysis lesson Sources and scope section. Scope statements are labelled Classroom or Supplementary: Classroom statements record what the session covered, and beginner-first wording developed afterwards is labelled Supplementary. No practical competence, completed assessment or exam alignment is implied.

Accountability, roles and silos

Evidence: Mixed

Revision: Available · 2 questions · 1 flashcard

Exam relevance

Learning-only · no verified exam mapping

Reviewed revision scope

• Governance oversight differs from operational implementation; CIO and CISO responsibilities vary; supplier approval requires ownership, cross-team assessment, communication and training.

• Session 4: Governance, Risk and Compliance — In Depth — Classroom session record
• Governance, Risk and Compliance (GRC) — Supplementary Study Guide explanation

Recorded evidence

• Governance oversight differs from operational implementation; CIO and CISO responsibilities vary; supplier approval requires ownership, cross-team assessment, communication and training.

• Session 4: Governance, Risk and Compliance — In Depth — Classroom session record · The Three GRC Pillars; Compliance ≠ Security; ISO/IEC 27001 and Continual Improvement; Why Consultants Need Business Context; Business Impact Analysis; Assessing Risk; Identifying and Managing Risk; Frameworks and Standards; UK GDPR and Data Protection; Data Classification and Handling
• Governance, Risk and Compliance (GRC) — Supplementary Study Guide explanation · Three connected responsibilities; Accountability and organisational roles; Departmental silos, communication and training; Compliance vs security

Reviewed 2026-09-22. Reviewed against approved Sessions 3–4 learning and Core Concepts explanations. Fictional applications are educational elaborations, not completed practical work. Learning-only; this concept has not yet been individually verified against the Security+ SY0-701 objectives or any other exam syllabus.

Three GRC pillars

Evidence: Mixed

Revision: Available · 1 question · 1 flashcard

Exam relevance

Learning-only · no verified exam mapping

Reviewed revision scope

• Governance assigns direction and accountability; risk assesses and treats uncertainty; compliance addresses applicable legal, contractual and internal requirements.

• Session 3: Governance, Risk and Compliance — Classroom session record
• Session 4: Governance, Risk and Compliance — In Depth — Classroom session record
• Governance, Risk and Compliance (GRC) — Supplementary Study Guide explanation

Recorded evidence

• Governance assigns direction and accountability; risk assesses and treats uncertainty; compliance addresses applicable legal, contractual and internal requirements.

• Session 3: Governance, Risk and Compliance — Classroom session record · Governance and Accountability; Risk and Measurement; Risk Management Lifecycle; Risk Treatment; Compliance Is Not the Same as Security; Risk Appetite vs Risk Tolerance; CVSS and Business Risk; ISO/IEC 27001 and 27002; Cyber Essentials; NIST Cybersecurity Framework; UK GDPR and Data Protection; Data Classification; UK GDPR Lawful Bases; ICO and the 72-Hour Rule; PCI DSS
• Session 4: Governance, Risk and Compliance — In Depth — Classroom session record · The Three GRC Pillars; Compliance ≠ Security; ISO/IEC 27001 and Continual Improvement; Why Consultants Need Business Context; Business Impact Analysis; Assessing Risk; Identifying and Managing Risk; Frameworks and Standards; UK GDPR and Data Protection; Data Classification and Handling
• Governance, Risk and Compliance (GRC) — Supplementary Study Guide explanation · Three connected responsibilities; Accountability and organisational roles; Departmental silos, communication and training; Compliance vs security

Reviewed 2026-09-22. Reviewed against approved Sessions 3–4 learning and Core Concepts explanations. Fictional applications are educational elaborations, not completed practical work. Learning-only; this concept has not yet been individually verified against the Security+ SY0-701 objectives or any other exam syllabus.

ISMS, ISO 27001 and PDCA

Evidence: Mixed

Revision: Available · 2 questions · 2 flashcards

Exam relevance

Learning-only · no verified exam mapping

Reviewed revision scope

• ISO 27001 specifies scoped ISMS requirements while ISO 27002 guides controls; Plan–Do–Check–Act uses implementation evidence and corrective action for continual improvement.

• Session 3: Governance, Risk and Compliance — Classroom session record
• Session 4: Governance, Risk and Compliance — In Depth — Classroom session record
• Security Frameworks and Standards — Supplementary Study Guide explanation

Recorded evidence

• ISO 27001 specifies scoped ISMS requirements while ISO 27002 guides controls; Plan–Do–Check–Act uses implementation evidence and corrective action for continual improvement.

• Session 3: Governance, Risk and Compliance — Classroom session record · Governance and Accountability; Risk and Measurement; Risk Management Lifecycle; Risk Treatment; Compliance Is Not the Same as Security; Risk Appetite vs Risk Tolerance; CVSS and Business Risk; ISO/IEC 27001 and 27002; Cyber Essentials; NIST Cybersecurity Framework; UK GDPR and Data Protection; Data Classification; UK GDPR Lawful Bases; ICO and the 72-Hour Rule; PCI DSS
• Session 4: Governance, Risk and Compliance — In Depth — Classroom session record · The Three GRC Pillars; Compliance ≠ Security; ISO/IEC 27001 and Continual Improvement; Why Consultants Need Business Context; Business Impact Analysis; Assessing Risk; Identifying and Managing Risk; Frameworks and Standards; UK GDPR and Data Protection; Data Classification and Handling
• Security Frameworks and Standards — Supplementary Study Guide explanation · Information security management; Plan–Do–Check–Act; Cyber Essentials and Cyber Essentials Plus; IASME and its schemes; NIST Cybersecurity Framework; Legal and payment-card obligations

Reviewed 2026-09-22. Reviewed against approved Sessions 3–4 learning and Core Concepts explanations. Fictional applications are educational elaborations, not completed practical work. Learning-only; this concept has not yet been individually verified against the Security+ SY0-701 objectives or any other exam syllabus.

Information Security Competencies

Evidence: Mixed

Revision: Available · 3 questions · 1 flashcard

Exam relevance

Learning-only · no verified exam mapping

Reviewed revision scope

• Classroom (Session 7): the competencies covered were risk assessments and testing; access control and user privileges; incident response and reporting; security training and education programmes; specifying, sourcing, installing and configuring secure devices and software; auditing logs and events; and business continuity and disaster recovery.
• Supplementary: the competencies are connected capability areas, not seven separate jobs, and can be remembered as a loop: assess risk, control access, secure systems, monitor activity, respond to incidents, recover operations, and improve people and processes.
• Supplementary: in plain words, auditing logs and events is reviewing records of what happened on systems; business continuity is keeping essential work going during a disruption and disaster recovery is restoring systems and data after a serious failure; training and education is helping staff understand the risks and what is expected of them; and specifying, sourcing, installing and configuring covers choosing suitable equipment and software, obtaining it from a trustworthy source and setting it up securely.

• Session 7: Security+ Session 1 — Security Concepts, Controls and Roles — Classroom session record
• Security Teams and Competencies — Supplementary Study Guide explanation

Recorded evidence

• Classroom (Session 7): the competencies covered were risk assessments and testing; access control and user privileges; incident response and reporting; security training and education programmes; specifying, sourcing, installing and configuring secure devices and software; auditing logs and events; and business continuity and disaster recovery.
• Supplementary: the competencies are connected capability areas, not seven separate jobs, and can be remembered as a loop: assess risk, control access, secure systems, monitor activity, respond to incidents, recover operations, and improve people and processes.
• Supplementary: in plain words, auditing logs and events is reviewing records of what happened on systems; business continuity is keeping essential work going during a disruption and disaster recovery is restoring systems and data after a serious failure; training and education is helping staff understand the risks and what is expected of them; and specifying, sourcing, installing and configuring covers choosing suitable equipment and software, obtaining it from a trustworthy source and setting it up securely.

• Session 7: Security+ Session 1 — Security Concepts, Controls and Roles — Classroom session record · The CIA triad; Non-repudiation; Security properties at a water-treatment plant; The NIST Cybersecurity Framework; Gap analysis; Identification, authentication, authorisation and accounting; What a security control is; Security control categories; Security control functional types; Information security roles and responsibilities; Due diligence and due care; Information security competencies; Security business units; Administrative (management) controls; Least privilege
• Security Teams and Competencies — Supplementary Study Guide explanation · What security professionals need to be able to do; The seven areas in plain words; Security teams and what each focuses on; Security Operations Centre; Incident response team; DevSecOps; A role is not a team; One change, six contributions; How the teams hand over

Reviewed 2026-10-02. Owner review completed on 2 October 2026. Checked during authoring against the Session 7 Learning Log and the Security Teams and Competencies lesson Sources and scope section. Scope statements are labelled Classroom or Supplementary: Classroom statements record what the session covered, and beginner-first wording developed afterwards is labelled Supplementary. No practical competence, completed assessment or exam alignment is implied.

Policies, procedures, evidence and SoA

Evidence: Mixed

Revision: Available · 3 questions · 2 flashcards

Exam relevance

• Security+ · 5.1 · direct

  This concept relates to the cited objective. Course coverage and authored revision do not establish full objective coverage.

Verified for Security+: 1 of 3 questions and 1 of 2 flashcards. The mapping does not verify the others.

Reviewed revision scope

• Policies set organisational rules and expectations.
• Standards specify requirements or recognised practices.
• Procedures describe step-by-step actions.
• Guidelines offer recommended practices.
• Policies set intent, procedures specify actions and evidence demonstrates operation; an ISO 27001 SoA records necessary controls, inclusion rationale, implementation status and justified Annex A exclusions, not every imaginable control.

• Session 2: Cyber Fundamentals Part 2 — Classroom session record
• Session 3: Governance, Risk and Compliance — Classroom session record
• Session 4: Governance, Risk and Compliance — In Depth — Classroom session record
• Security Documentation — Supplementary Study Guide explanation

Recorded evidence

• Policies set organisational rules and expectations.
• Standards specify requirements or recognised practices.
• Procedures describe step-by-step actions.
• Guidelines offer recommended practices.
• Policies set intent, procedures specify actions and evidence demonstrates operation; an ISO 27001 SoA records necessary controls, inclusion rationale, implementation status and justified Annex A exclusions, not every imaginable control.

• Session 2: Cyber Fundamentals Part 2 — Classroom session record · The CIA Triad; The DAD Triad; Securing Devices; Denial; DDoS Mitigation; Security, Usability and Functionality; Policies, Standards, Procedures and Guidelines
• Session 3: Governance, Risk and Compliance — Classroom session record · Governance and Accountability; Risk and Measurement; Risk Management Lifecycle; Risk Treatment; Compliance Is Not the Same as Security; Risk Appetite vs Risk Tolerance; CVSS and Business Risk; ISO/IEC 27001 and 27002; Cyber Essentials; NIST Cybersecurity Framework; UK GDPR and Data Protection; Data Classification; UK GDPR Lawful Bases; ICO and the 72-Hour Rule; PCI DSS
• Session 4: Governance, Risk and Compliance — In Depth — Classroom session record · The Three GRC Pillars; Compliance ≠ Security; ISO/IEC 27001 and Continual Improvement; Why Consultants Need Business Context; Business Impact Analysis; Assessing Risk; Identifying and Managing Risk; Frameworks and Standards; UK GDPR and Data Protection; Data Classification and Handling
• Security Documentation — Supplementary Study Guide explanation · Four useful distinctions; A fictional access-management example; Records that support decisions; Statement of Applicability

Reviewed 2026-09-22. Reviewed against approved Sessions 3–4 learning and Core Concepts explanations. Fictional applications are educational elaborations, not completed practical work. Learning-only; this concept has not yet been individually verified against the Security+ SY0-701 objectives or any other exam syllabus.

Frameworks and assurance schemes

Evidence: Mixed

Revision: Available · 5 questions · 2 flashcards

Exam relevance

Learning-only · no verified exam mapping

Reviewed revision scope

• NIST CSF 2.0 has Govern, Identify, Protect, Detect, Respond and Recover; Cyber Essentials uses verified self-assessment and Plus technical verification; IASME is an organisation with distinct schemes; PCI DSS addresses relevant payment-card environments rather than replacing law.

• Session 3: Governance, Risk and Compliance — Classroom session record
• Session 4: Governance, Risk and Compliance — In Depth — Classroom session record
• Security Frameworks and Standards — Supplementary Study Guide explanation

Recorded evidence

• NIST CSF 2.0 has Govern, Identify, Protect, Detect, Respond and Recover; Cyber Essentials uses verified self-assessment and Plus technical verification; IASME is an organisation with distinct schemes; PCI DSS addresses relevant payment-card environments rather than replacing law.

• Session 3: Governance, Risk and Compliance — Classroom session record · Governance and Accountability; Risk and Measurement; Risk Management Lifecycle; Risk Treatment; Compliance Is Not the Same as Security; Risk Appetite vs Risk Tolerance; CVSS and Business Risk; ISO/IEC 27001 and 27002; Cyber Essentials; NIST Cybersecurity Framework; UK GDPR and Data Protection; Data Classification; UK GDPR Lawful Bases; ICO and the 72-Hour Rule; PCI DSS
• Session 4: Governance, Risk and Compliance — In Depth — Classroom session record · The Three GRC Pillars; Compliance ≠ Security; ISO/IEC 27001 and Continual Improvement; Why Consultants Need Business Context; Business Impact Analysis; Assessing Risk; Identifying and Managing Risk; Frameworks and Standards; UK GDPR and Data Protection; Data Classification and Handling
• Security Frameworks and Standards — Supplementary Study Guide explanation · Information security management; Plan–Do–Check–Act; Cyber Essentials and Cyber Essentials Plus; IASME and its schemes; NIST Cybersecurity Framework; Legal and payment-card obligations

Reviewed 2026-09-22. Reviewed against approved Sessions 3–4 learning and Core Concepts explanations. Fictional applications are educational elaborations, not completed practical work. Learning-only; this concept has not yet been individually verified against the Security+ SY0-701 objectives or any other exam syllabus.

Security Roles: CIO, CISO, CSO and ISSO

Evidence: Mixed

Revision: Available · 3 questions · 1 flashcard

Exam relevance

Learning-only · no verified exam mapping

Reviewed revision scope

• Classroom (Session 7): the roles slide listed the CIO, Chief Information Officer, and the CSO, Chief Security Officer, under overall responsibility, and the ISSO, Information Systems Security Officer, under technical; the ISSO was also discussed as a role in exam-style scenario questions.
• Classroom (Session 4): senior leaders, including a CIO or CISO where those roles exist, may lead implementation and governance, while top management retains responsibility for leadership, resources and accountability.
• Supplementary: the CIO leads overall information-technology strategy and operations; the CISO, Chief Information Security Officer, leads information and cybersecurity strategy, governance, risk and protection; a CSO may have a broader remit that includes physical and corporate security as well as information security.
• Supplementary: an ISSO is system-focused, helping to ensure that particular information systems meet their security requirements and that their controls, documentation, risks and remediation are managed; a CISO or CSO looks across the whole organisation.
• Supplementary: job titles and reporting lines are not identical across organisations: roles may be combined, outsourced or named differently, and everyone shares some responsibility for security while overall responsibility stays with senior leadership.

• Session 4: Governance, Risk and Compliance — In Depth — Classroom session record
• Session 7: Security+ Session 1 — Security Concepts, Controls and Roles — Classroom session record
• Security Roles and Responsibilities — Supplementary Study Guide explanation

Recorded evidence

• Classroom (Session 7): the roles slide listed the CIO, Chief Information Officer, and the CSO, Chief Security Officer, under overall responsibility, and the ISSO, Information Systems Security Officer, under technical; the ISSO was also discussed as a role in exam-style scenario questions.
• Classroom (Session 4): senior leaders, including a CIO or CISO where those roles exist, may lead implementation and governance, while top management retains responsibility for leadership, resources and accountability.
• Supplementary: the CIO leads overall information-technology strategy and operations; the CISO, Chief Information Security Officer, leads information and cybersecurity strategy, governance, risk and protection; a CSO may have a broader remit that includes physical and corporate security as well as information security.
• Supplementary: an ISSO is system-focused, helping to ensure that particular information systems meet their security requirements and that their controls, documentation, risks and remediation are managed; a CISO or CSO looks across the whole organisation.
• Supplementary: job titles and reporting lines are not identical across organisations: roles may be combined, outsourced or named differently, and everyone shares some responsibility for security while overall responsibility stays with senior leadership.

• Session 4: Governance, Risk and Compliance — In Depth — Classroom session record · The Three GRC Pillars; Compliance ≠ Security; ISO/IEC 27001 and Continual Improvement; Why Consultants Need Business Context; Business Impact Analysis; Assessing Risk; Identifying and Managing Risk; Frameworks and Standards; UK GDPR and Data Protection; Data Classification and Handling
• Session 7: Security+ Session 1 — Security Concepts, Controls and Roles — Classroom session record · The CIA triad; Non-repudiation; Security properties at a water-treatment plant; The NIST Cybersecurity Framework; Gap analysis; Identification, authentication, authorisation and accounting; What a security control is; Security control categories; Security control functional types; Information security roles and responsibilities; Due diligence and due care; Information security competencies; Security business units; Administrative (management) controls; Least privilege
• Security Roles and Responsibilities — Supplementary Study Guide explanation · Who is responsible for security; CIO, CISO and CSO; The ISSO: security of particular systems; Titles vary between organisations; Due diligence and due care; An example: ransomware; Why both are needed

Reviewed 2026-10-02. Owner review completed on 2 October 2026. Checked during authoring against the Session 7 Learning Log and the Security Roles and Responsibilities lesson Sources and scope section. Scope statements are labelled Classroom or Supplementary: Classroom statements record what the session covered, and beginner-first wording developed afterwards is labelled Supplementary. No practical competence, completed assessment or exam alignment is implied.

Security Teams: SOC, CIRT and DevSecOps

Evidence: Mixed

Revision: Available · 4 questions · 1 flashcard

Exam relevance

Learning-only · no verified exam mapping

Reviewed revision scope

• Classroom (Session 7): the security business units covered were the SOC, Security Operations Centre; DevSecOps, Development, Security and Operations; and the CIRT, Computer Incident Response Team; the ISSO was discussed as a role.
• Supplementary: the SOC focuses on continuous monitoring, detection, analysis, investigation and escalation; the incident response team, called a CIRT or a CERT (Computer Emergency Response Team), focuses on responding to security incidents, including investigation, containment and coordinating recovery; DevSecOps builds security into development and operations from the beginning instead of adding it at the end.
• Supplementary: the ISSO is an individual role responsible for the security of particular systems, not a team or business unit; the SOC, the incident response team and DevSecOps are teams or functions.
• Supplementary: in the cloud-platform scenario, the CIO decides how the platform fits IT strategy and operations, the CISO or CSO considers security strategy, risk and required controls, DevSecOps builds security into development and deployment, the ISSO checks the system’s controls, documentation, vulnerabilities and remediation, the SOC monitors the resulting security events, and the CIRT or CERT responds if a security incident occurs.
• Supplementary: the teams hand work to each other: the SOC escalates a confirmed incident to the incident response team, and in a small organisation the same work may be done by one or two people or bought in.

• Session 7: Security+ Session 1 — Security Concepts, Controls and Roles — Classroom session record
• Security Teams and Competencies — Supplementary Study Guide explanation

Recorded evidence

• Classroom (Session 7): the security business units covered were the SOC, Security Operations Centre; DevSecOps, Development, Security and Operations; and the CIRT, Computer Incident Response Team; the ISSO was discussed as a role.
• Supplementary: the SOC focuses on continuous monitoring, detection, analysis, investigation and escalation; the incident response team, called a CIRT or a CERT (Computer Emergency Response Team), focuses on responding to security incidents, including investigation, containment and coordinating recovery; DevSecOps builds security into development and operations from the beginning instead of adding it at the end.
• Supplementary: the ISSO is an individual role responsible for the security of particular systems, not a team or business unit; the SOC, the incident response team and DevSecOps are teams or functions.
• Supplementary: in the cloud-platform scenario, the CIO decides how the platform fits IT strategy and operations, the CISO or CSO considers security strategy, risk and required controls, DevSecOps builds security into development and deployment, the ISSO checks the system’s controls, documentation, vulnerabilities and remediation, the SOC monitors the resulting security events, and the CIRT or CERT responds if a security incident occurs.
• Supplementary: the teams hand work to each other: the SOC escalates a confirmed incident to the incident response team, and in a small organisation the same work may be done by one or two people or bought in.

• Session 7: Security+ Session 1 — Security Concepts, Controls and Roles — Classroom session record · The CIA triad; Non-repudiation; Security properties at a water-treatment plant; The NIST Cybersecurity Framework; Gap analysis; Identification, authentication, authorisation and accounting; What a security control is; Security control categories; Security control functional types; Information security roles and responsibilities; Due diligence and due care; Information security competencies; Security business units; Administrative (management) controls; Least privilege
• Security Teams and Competencies — Supplementary Study Guide explanation · What security professionals need to be able to do; The seven areas in plain words; Security teams and what each focuses on; Security Operations Centre; Incident response team; DevSecOps; A role is not a team; One change, six contributions; How the teams hand over

Reviewed 2026-10-02. Owner review completed on 2 October 2026. Checked during authoring against the Session 7 Learning Log and the Security Teams and Competencies lesson Sources and scope section. Scope statements are labelled Classroom or Supplementary: Classroom statements record what the session covered, and beginner-first wording developed afterwards is labelled Supplementary. No practical competence, completed assessment or exam alignment is implied.