Ethics, Governance and Risk Decisions
This topic covers the ISC2 ethics mindset, security governance, business alignment, risk ownership, due care, due diligence, control frameworks, and risk response.
How to study for CISSP
Treat each CISSP question as a risk decision: identify the owner, objective, control type, lifecycle phase, and business consequence before choosing.
Core concepts
Concept 1
Ethics, Governance and Risk Decisions questions test whether a security leader can choose a defensible control, process, or governance response for a business risk.
Exam cue: Identify the domain objective: govern risk, protect assets, engineer securely, secure networks, control identity, test, operate, or secure software.
Concept 2
The best CISSP answer usually protects people, policy, data, and mission before jumping to a narrow technical fix.
Exam cue: Match the response to the risk owner, data owner, control objective, lifecycle phase, and assurance evidence in the scenario.
Concept 3
Eliminate answers that skip authorization, ignore legal or contractual duties, weaken least privilege, or confuse preventive, detective, and corrective controls.
Exam cue: Prefer documented policy, due care, defense in depth, least privilege, validated recovery, and continuous improvement.
Risk pitfalls and guardrails
Choosing a tool before confirming business requirements, ownership, and risk treatment.
Guardrail: Avoid answers that jump to a tool, ignore the risk owner, weaken least privilege, skip evidence, or treat one security objective as the only concern.
Treating confidentiality as the only goal when integrity, availability, authenticity, accountability, and safety also matter.
Guardrail: Avoid answers that jump to a tool, ignore the risk owner, weaken least privilege, skip evidence, or treat one security objective as the only concern.
Ignoring legal, regulatory, contractual, audit, and evidence-handling obligations.
Guardrail: Avoid answers that jump to a tool, ignore the risk owner, weaken least privilege, skip evidence, or treat one security objective as the only concern.
Memory anchors
ISC2 Ethics
ISC2 ethics questions favor protecting society, acting honorably, providing competent service, and advancing the profession.
Due Care
Due care is the reasonable action a prudent organization takes to protect assets and people.
Due Diligence
Due diligence is the investigation and ongoing effort used to understand and manage risk.
Risk Owner
A risk owner is accountable for deciding whether to avoid, transfer, mitigate, or accept risk.
Control Framework
A control framework organizes security objectives, control families, and assurance expectations.
Risk Treatment
Risk treatment selects avoid, transfer, mitigate, or accept based on business risk appetite.
Security Governance
Security governance aligns security strategy, roles, policies, and measurement with organizational objectives.
Policy Hierarchy
Policies set intent, standards define mandatory requirements, procedures give steps, and guidelines offer advice.
Threat Modeling
Threat modeling identifies likely threats, attack paths, controls, and residual risk before or during design.
Compliance Duty
Compliance duties come from laws, regulations, contracts, standards, and internal policy obligations.
Checkpoint rule
Do the check-up only after you can summarize each concept in one sentence and identify one dangerous pitfall from memory.
Knowledge Check (after reading)
Short check-up to confirm understanding of this module.
Check-up Questions
A security consultant discovers that a client's product can expose patients to physical harm. The client asks the consultant to remain silent until the next release. What should the consultant do FIRST?
A payroll manager accidentally receives access to employee medical records. No evidence shows that the records were viewed or changed. Which security objective has already been violated?
Answer all questions to submit.
Next step personalized recommendations
Continue learning
Move forward only after this module is stable.
What is Pass Harbor?
Completely free exam prep for 317 U.S. exams.
- Practice questions
- Flashcards
- Study guides
- Mock exams
- No registration
- No paywall
- Start instantly
“No more expensive exam prep. Quality study tools should be accessible to everyone.”