SY0-801 security program management explained
Security Program Management and Oversight is worth 14% of SY0-801, down from 20% in SY0-701. It has six objectives (5.1 to 5.6) on governance, risk, third parties, compliance, audits and awareness. It is vocabulary-heavy and calculation-light, which makes it a good domain to master quickly.
5.1 Governance, risk and compliance artifacts
| Type | Examples |
|---|---|
| Guidelines | Benchmarks, advisories, implementation guides, reference architecture |
| Standards | Baselines, password, physical security, encryption standards |
| Procedures | Standard operating procedures, runbooks |
| Plans | Business continuity, disaster recovery |
| Policies | BYOD, acceptable use, clean desk, information security, incident response, data classification, access control, data disposal, vulnerability disclosure, privacy |
Policies state intent and are mandatory; standards define specific requirements; procedures give steps; guidelines are advice.
5.2 Risk management
Risk work follows identification, assessment (scoring, categorisation), analysis (impact, likelihood, owner, current mitigations; qualitative versus quantitative), registering, communication and treatment. The four treatments are transfer (insurance, contracts), accept, avoid and mitigate.
Business considerations include the business impact analysis (BIA), risk appetite and residual risk. The formulas:
- SLE is the loss from one event.
- ARO is how many times a year it is expected.
- ALE = SLE x ARO.
If an asset is worth 200,000 dollars, an event damages 25% of it and happens twice a year, SLE is 50,000 and ALE is 100,000.
5.3 Third-party risk
Vendor selection uses RFP, RFI, RFQ and expression of interest, with due diligence and conflict-of-interest checks. Agreements:
| Document | Purpose |
|---|---|
| SLA | Measurable service levels with consequences |
| SLO | A target within a service level |
| MOU / MOA | Non-binding or binding statement of shared intent |
| NDA | Confidentiality |
| MSA | Master terms for an ongoing relationship |
| SOW | Specific work, deliverables and timeline |
Monitoring tools include the right to audit, a vendor registry, vendor assessments and compliance attestation. Rules of engagement set the scope of any penetration test.
5.4 Compliance
Elements include compliance training, monitoring, attestations, and the consequences of non-compliance (fines, sanctions, loss of licence, reputational and contractual damage). Privacy topics are the right to be forgotten, opt-in or opt-out, data correction, processing restrictions, controller versus processor, legal hold and retention requirements.
5.5 Audit and assessment
Audits gather data via sampling, questionnaires and interviews, using references such as MITRE ATT&CK, the Cyber Kill Chain and the Diamond Model. Penetration tests are classified by knowledge (known, partially known, unknown environment), by approach (offensive, defensive, integrated) and by reconnaissance (passive or active).
5.6 Awareness
Training can be initial, ongoing, targeted or corrective, delivered through an LMS, portals or in person, and its effectiveness is measured with metrics and personnel behaviour risk scoring. Topics include social engineering, password management, remote work, BYOD, business email compromise, removable media and operational security.
Example questions
Question 1. A company buys cyber insurance to cover ransom and recovery costs. Which risk treatment is this?
- A. Avoid
- B. Accept
- C. Transfer
- D. Mitigate
Show answer
Answer: C
Insurance moves the financial impact to another party, which is transfer. Avoiding would stop the activity, accepting would take the loss without cover, and mitigating would reduce likelihood or impact with controls.
Want more questions like this? Full SY0-801 practice tests →
Question 2. Under an existing master agreement, which document defines the specific tasks, deliverables and timeline for a new project?
- A. Statement of work
- B. Non-disclosure agreement
- C. Memorandum of understanding
- D. Service-level agreement
Show answer
Answer: A
A statement of work specifies a particular piece of work. An NDA covers confidentiality, an MOU states shared intent, and an SLA defines service levels for an ongoing service.
Want more questions like this? Full SY0-801 practice tests →
Question 3. Testers are given no prior information about a company's systems. Which penetration test type is this?
- A. Known environment
- B. Unknown environment
- C. Partially known environment
- D. Integrated
Show answer
Answer: B
Testing without prior information is an unknown environment test. A known environment gives full detail, a partially known environment gives some, and integrated describes combining offensive and defensive work.
Want more questions like this? Full SY0-801 practice tests →
Revision tips
Learn the agreement types with a one-line distinction. Do three ALE calculations every day in the last week. See also Is SY0-801 hard?.