Skip to main content

Information Security

Governance, risk, compliance, policy, awareness and incident response - the management side of security that turns technical controls into an organizational program.

NOTE

This category covers defensive / governance topics. All material is for authorized use, education and certification preparation only.

Scope​

This category covers the non-technical (or cross-technical) disciplines that every security program needs:

  • Governance: who decides, who is accountable, what frameworks apply.
  • Risk: how risk is identified, assessed, treated and reported.
  • Compliance: which laws and standards apply and how to prove conformity.
  • Policy: what the organization requires of its people and systems.
  • Awareness: how people learn to recognize and report threats.
  • Incident Response and Business Continuity: how the organization detects, responds and recovers.

Technical depth (exploitation, tooling, detection engineering) lives in the other categories. This category links to them where the process depends on a technical control.

Subcategories​

#SubcategoryFilesFocus
01Governance and Frameworks5ISO 27001, NIST CSF, COBIT, roles, security strategy
02Risk Management5Risk assessment, treatment, third-party risk
03Compliance and Regulation5Regulatory landscape, control mapping, audit
04Security Policies and Standards5Policy hierarchy, standards, lifecycle, exceptions
05Security Awareness and Training5Phishing programs, training, metrics, culture
06Incident Response and Business Continuity5IR lifecycle, playbooks, BCP, DR, tabletop exercises

Format​

Files in this category use the process-based format (see the category layout): each file follows the process, not the attack/defense split. Every file includes:

  • Overview and scope.
  • Where in the organization the process sits.
  • Threats and failure modes.
  • Controls and implementation.
  • Tooling.
  • Verification and metrics.
  • Anti-patterns.
  • Certification Alignment.
  • References.

Certification Alignment​

This category maps to governance / management certifications. See CERTIFICATIONS.md for the full matrix. Core: Security+, CISSP, CISM. Extended: CRISC, CISA, ISO 27001 LI/LA, CySA+.

  • INFRASTRUCTURE - technical controls that governance and policy describe.
  • CLOUD - cloud compliance and shared-responsibility mapping.
  • AI - AI governance and risk.
  • DEVSECOPS (planned) - security built into the SDLC.
  • CTI (planned) - intelligence that feeds risk and incident response.

References​