Security+ Domain 5 Study Guide: Security Program Management and Oversight (SY0-701)
Reach 50,000+ security professionals
Sponsor a newsletter slot and put your brand in front of CISOs, engineers, and IT decision-makers.
Security Program Management and Oversight is 20% of the Security+ SY0-701 exam and has 6 objectives. This study guide lists each objective with its official title, summarizes the concepts you need in tables, flags the exam traps that cost points, and gives three original practice questions with explanations for every option. The concept tables are our own summaries of standard Security+ topics, and the official CompTIA objectives document is the authority for what is tested.
Domain 5 at a Glance
Security Program Management and Oversight is 20% of the Security+ SY0-701 exam. It has 6 objectives, listed below with their official titles. The concept tables are our own summaries of standard Security+ topics, and the official CompTIA objectives document is the authority for what is tested.
| Objective | Official title |
|---|---|
| 5.1 | Summarize elements of effective security governance. |
| 5.2 | Explain elements of the risk management process. |
| 5.3 | Explain the processes associated with third-party risk assessment and management. |
| 5.4 | Summarize elements of effective security compliance. |
| 5.5 | Explain types and purposes of audits and assessments. |
| 5.6 | Given a scenario, implement security awareness practices. |
Governance
| Element | What to know |
|---|---|
| Policies | Acceptable use, information security, business continuity, disaster recovery, incident response, SDLC, change management |
| Standards and procedures | Standards set required levels such as password or encryption rules. Procedures give step-by-step instructions |
| External considerations | Regulatory, legal, industry, and local, regional, national and global requirements |
| Roles | Data owner is accountable. Controller decides why and how personal data is used. Processor handles it on the controller's behalf. Custodian or steward manages it day to day |
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
Risk Management
| Concept | What to know |
|---|---|
| Qualitative versus quantitative | Ratings like high and low, versus numbers like SLE, ARO and ALE |
| Formulas | SLE equals asset value times exposure factor. ALE equals SLE times ARO |
| Risk register | Tracks risks, owners, key risk indicators and thresholds |
| Appetite and tolerance | Appetite can be expansionary, conservative or neutral. Tolerance is the acceptable variation |
| Strategies | Mitigate, transfer, accept, avoid, with exceptions and exemptions documented |
| Business impact analysis | Identifies critical functions and sets RTO and RPO, and informs MTTR and MTBF planning |
Example: an $80,000 server with a 40 percent exposure factor has an SLE of $32,000.
Third-Party Risk
| Agreement | Purpose |
|---|---|
| MSA (master service agreement) | Overarching legal terms that later work operates under |
| SOW or work order | Defines specific work, deliverables and timelines |
| SLA (service-level agreement) | States the service levels a provider must meet |
| NDA (non-disclosure agreement) | Protects confidential information |
| MOU and MOA | A memorandum of understanding states shared intentions. A memorandum of agreement is more formal about each party's obligations |
| BPA (business partners agreement) | Governs a partnership between businesses |
Vendor assessment can include due diligence, right-to-audit clauses, independent assessments, questionnaires and supply chain analysis.
Compliance, Audits and Awareness
Compliance: reporting, monitoring and the consequences of non-compliance such as fines, sanctions, reputational damage, loss of license and contractual impact. Privacy concepts include data subjects, controllers and processors, data inventory and retention and the right to be forgotten.
Audits and assessments: internal and external audits, attestation and penetration testing. Test types are known environment, partially known environment and unknown environment, with passive or active reconnaissance.
Awareness: phishing campaigns, recognizing and responding to reported messages, anomalous behavior, user training and measuring effectiveness. The first response to a reported suspicious email is to analyze it and, if it is malicious, remove it from other mailboxes.
Common Exam Traps
These mix-ups cost points in this domain.
SLE, ARO and ALE
Multiply asset value by exposure factor for SLE, then SLE by annual rate for ALE. Do the math in the order given.
MSA versus SOW
The MSA sets the general terms once. Each SOW describes a specific piece of work under those terms.
Controller versus processor
The controller decides why and how personal data is used. The processor acts on the controller's instructions.
Appetite versus tolerance
Appetite is how much risk the organization is willing to pursue. Tolerance is the acceptable deviation from that level.
Try It: Three Domain 5 Practice Questions
Answer these before you read the key. They are original questions written to the published objectives, and none are real exam questions.
Question 1. A fast-growing startup is willing to take on significant risk in order to enter new markets quickly. Which risk appetite does this describe?
- A. Conservative
- B. Neutral
- C. Expansionary
- D. Residual
Question 2. A company wants a single agreement that sets the general legal terms with a vendor so that future projects can be added through separate documents without renegotiating those terms. Which agreement should be used?
- A. Master service agreement (MSA)
- B. Statement of work
- C. Memorandum of agreement
- D. Non-disclosure agreement
Question 3. An employee reports a suspicious email but has not clicked anything in it. What should the security team do FIRST?
- A. Analyze the message and, if malicious, purge it from all mailboxes
- B. Disable the employee's account immediately
- C. Reply to the sender to confirm the message is fake
- D. Tell the employee to simply delete it and take no further action on the report
Answer Key and Explanations
Question 1: C. Expansionary (objective 5.2)
An expansionary appetite accepts higher risk in pursuit of growth and opportunity.
- A. Conservative. A conservative appetite prefers minimal risk, the opposite of this company.
- B. Neutral. A neutral appetite balances risk and reward without actively seeking more risk.
- D. Residual. Residual risk is the risk remaining after controls, not a type of appetite.
Question 2: A. Master service agreement (MSA) (objective 5.3)
An MSA establishes the overarching terms that later work orders operate under.
- B. Statement of work. A statement of work covers the scope and deliverables of one project, not the umbrella terms.
- C. Memorandum of agreement. A memorandum of agreement documents a specific shared commitment, not reusable umbrella terms.
- D. Non-disclosure agreement. An NDA only addresses confidentiality and is not a general framework for services.
Question 3: A. Analyze the message and, if malicious, purge it from all mailboxes (objective 5.6)
Analyzing the message and removing it from other mailboxes contains the threat and protects other recipients.
- B. Disable the employee's account immediately. The employee did not interact with the message, so disabling the account is unnecessary.
- C. Reply to the sender to confirm the message is fake. Replying to a suspected attacker confirms an active mailbox and can expose the team.
- D. Tell the employee to simply delete it and take no further action on the report. Simply deleting it leaves the same message in other recipients' mailboxes.
How to Study Domain 5
Domain 5 carries 20% of the exam. See our objectives explained for all five domains, the study plan for how to split your days by weight, and the commonly confused terms cheat sheet for the pairs that appear here.
Practice the risk formulas
Work three or four SLE and ALE examples with different numbers until the steps are automatic.
Learn the agreement types as a set
Make a one-line description of each agreement and test yourself on which fits a scenario.
Retry misses on different days
A widely cited review of learning techniques rated practice testing and spaced practice as high utility. Return to the questions you miss a few days later instead of rereading the same pages.
Practice With DD Academy
DD Academy has Security+ flashcards and practice questions for every objective in Domain 5, plus an AI tutor that explains why each option is right or wrong. It is free to start on iPhone and the web.
The bottom line
Know the 6 Domain 5 objectives, learn the concept tables until you can explain each term without notes, watch for the traps listed above and keep practicing with scenario questions across all five domains.
Frequently asked questions
What percentage of Security+ is Domain 5?
Security Program Management and Oversight is 20% of SY0-701 according to CompTIA. On SY0-801 it drops to 14%, the largest decrease of any domain.
How many objectives are in Domain 5?
Six on SY0-701: 5.1 governance, 5.2 risk management, 5.3 third-party risk, 5.4 compliance, 5.5 audits and assessments and 5.6 security awareness.
How do you calculate single loss expectancy?
Multiply the asset value by the exposure factor. For example, an $80,000 asset with a 40 percent exposure factor has an SLE of $32,000. Multiply the SLE by the annualized rate of occurrence to get the annualized loss expectancy.
What is the difference between an MSA and an SOW?
A master service agreement sets the general legal terms between a company and a vendor. A statement of work describes a specific project and operates under those terms.
What is an expansionary risk appetite?
An organization willing to accept higher risk in pursuit of growth, such as a fast-growing startup entering new markets quickly. Conservative and neutral are the other appetites.
What should you do first when an employee reports a suspicious email?
Analyze the message and, if it is malicious, purge it from all mailboxes to contain the threat and protect other recipients.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Daily briefings + Google Top Stories in one step.
Enter your email and we'll subscribe you to the daily briefing and add Decryption Digest to your Google Search feed at the same time.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.
