CompTIA Security+ (SY0-701) — Complete Study Guide (2026)

The smallest domain, but often the easiest points on the exam if you read the chapter. Governance sets direction and authority; risk management decides where to spend; compliance keeps you legal. Together they align security with the business.

Teaching: Policies and Governance

Governance gives a security program structure, authority, and accountability. Know the hierarchy of documents:

• Policies - high-level statements of intent, approved by leadership.
• Standards - specific, mandatory requirements supporting policies (e.g., "passwords must be at least 14 characters").
• Procedures - step-by-step instructions.
• Guidelines - recommended, non-mandatory best practices.

Common policies: acceptable use policy (AUP) (permitted and prohibited use, acknowledged as a condition of access), information security policy, business continuity and disaster recovery policy, incident response policy, change management policy, and software development lifecycle policy.

Governance also defines who is in charge through boards and committees and through data roles:

• Data owner - overall accountability for a data set.
• Data controller - determines how and why data is processed.
• Data processor - acts on the controller's behalf.
• Data custodian - manages storage and technical protection.
• Data steward - oversees quality and appropriate use.

Security awareness training teaches users to recognize phishing and social engineering, handle data properly, and report incidents - reducing human risk that technology alone cannot. Effective programs run continuously, use simulated phishing, and tailor content by role.

Governance frameworks give proven structure. The NIST Cybersecurity Framework organizes activities into Identify, Protect, Detect, Respond, Recover. Other references: the ISO 27000 series, COBIT, NIST SP 800-53, and the CIS Controls.

Teaching: Risk Management

Risk management identifies, measures, and treats risk within the organization's tolerance.

It begins with risk identification and a risk assessment (ad hoc, recurring, one-time, or continuous), producing a risk register recording each risk with its owner, likelihood, impact, and treatment. Analysis is qualitative (high/medium/low) or quantitative (dollar figures).

The quantitative formulas are prime exam targets:

• SLE (Single Loss Expectancy) = Asset Value x Exposure Factor.
• ARO (Annualized Rate of Occurrence) = expected occurrences per year.
• ALE (Annualized Loss Expectancy) = SLE x ARO.

Example: a laptop worth $2,000 has a 50% chance of loss per incident, so SLE = $2,000 x 0.5 = $1,000. If such incidents happen twice a year (ARO = 2), then ALE = $1,000 x 2 = $2,000 per year. If a $500-per-year control would prevent it, spending on the control is justified because the ALE it removes ($2,000) exceeds its cost.

Risk appetite is the amount of risk leadership is willing to accept; key risk indicators track exposure. Once a risk is understood, choose a response:

• Mitigate - apply controls to reduce likelihood or impact.
• Transfer - shift financial impact to a third party (insurance, contract terms).
• Avoid - stop the risky activity entirely.
• Accept - acknowledge and take no further action (sometimes with a formal exception).

After controls, residual risk remains, and management must formally acknowledge and accept it. Business impact analysis (BIA) identifies critical functions and quantifies disruption impact, feeding recovery objectives.

Third-party and supply-chain risk deserves special attention: vendor due diligence, questionnaires, independent audits, ongoing monitoring, and managing risk from hardware suppliers, software providers, and managed service providers.

Teaching: Data Classification and Handling in Practice

Governance turns abstract policy into daily action largely through data classification, and the exam expects you to see how a classification scheme drives handling. Classification begins by labeling information according to sensitivity - common commercial tiers are public, internal/private, confidential, and restricted/critical, while government schemes run from unclassified through secret and top secret. The data owner assigns the classification, because only the business, not IT, can judge how damaging disclosure would be.

Each tier then dictates handling requirements: who may access it, whether it must be encrypted at rest and in transit, how it may be transmitted, where it may be stored, and how it must be destroyed. Restricted data might require encryption everywhere, multifactor access, and shredding or degaussing at disposal, while public data needs none of that. This is how classification connects to nearly every other domain - it tells the architecture which data to encrypt, tells operations which systems to monitor most closely, and tells compliance which regulations apply. Labeling and marking make the classification visible so users handle data correctly, and data loss prevention tools enforce the rules automatically by recognizing classified patterns. The recurring exam lesson is that you cannot protect data appropriately until you have classified it, so classification is the practical first step of a data-protection program, and applying controls proportionate to sensitivity - neither over- nor under-protecting - is the mark of a mature program.

Concrete Examples

A retailer calculates that a payment-system outage would cost $40,000 per event and is expected once every two years (ARO = 0.5), giving an ALE of $20,000. A redundant system costs $8,000 per year. Because $8,000 is less than the $20,000 annual expected loss, mitigation is financially rational. This is precisely how the exam frames a "should they buy the control" question - compute ALE, compare to control cost.

A company buys cyber-insurance to cover breach costs. It has not reduced the chance of a breach; it has transferred the financial impact. If instead it deployed EDR to reduce breach likelihood, that is mitigation. If it shut down the risky legacy service entirely, that is avoidance. If it decided the risk was small and did nothing, that is acceptance.

KEY CONCEPT: The four risk responses, and the ALE math. Mitigate (reduce), Transfer (insure/contract), Avoid (stop the activity), Accept (do nothing). Insurance is transfer, not mitigation - a favorite trap. And remember SLE = Asset Value x Exposure Factor, ALE = SLE x ARO. A control is worth buying when its annual cost is less than the ALE it eliminates.

Teaching: Regulations and Standards

Organizations operate under laws and standards governing sensitive data. Non-compliance brings fines, liability, and reputational harm.

• GDPR (General Data Protection Regulation) - protects EU residents' personal data; requires a lawful basis such as consent, grants data-subject rights (access, erasure), mandates breach notification, and applies to any organization handling EU residents' data regardless of location.
• HIPAA - safeguards protected health information (PHI) for US healthcare providers, plans, and business associates.
• PCI DSS - a contractual industry standard, not a law, mandating controls for anyone storing, processing, or transmitting payment card data; enforced by the card brands.
• Others: SOX (financial reporting integrity), GLBA (financial privacy), and regional privacy laws.

Compliance is ongoing: monitoring (internal and external), attestation, and consequences for non-compliance ranging from fines and sanctions to loss of license, plus reputational damage.

Underpinning compliance is data governance:

• Data classification labels information by sensitivity - public, private, sensitive, confidential, restricted, critical, or governmental levels (unclassified through top secret) - so appropriate handling applies to each tier.
• Data types: regulated data, PII (personally identifiable information), PHI, intellectual property, trade secrets, financial data.
• Data states: at rest, in transit, in use - each needing protective controls.
• Data sovereignty - data is subject to the laws of the country where it resides, shaping cloud region choices; geographic restrictions limit where data may travel.
• Data retention - keep data only as long as law and business need require, then dispose securely.

Teaching: Agreements and Continuity

Formal agreements set expectations with third parties. Know each by purpose:

• SLA (Service Level Agreement) - measurable commitments (uptime, response times) with consequences; the primary tool for holding vendors accountable.
• MOU (Memorandum of Understanding) - a non-binding statement of intent to cooperate.
• BPA (Business Partnership Agreement) - terms of a partnership, including responsibilities.
• MSA (Master Service Agreement) - overarching terms, under which a SOW (Statement of Work) describes specific deliverables.
• NDA (Non-Disclosure Agreement) - legally binds parties to keep confidential information secret.
• ISA (Interconnection Security Agreement) - governs the secure connection between two organizations' systems.

Continuity planning prepares for disruption:

• Business impact analysis (BIA) identifies critical functions and sets RTO and RPO.
• A business continuity plan (BCP) keeps essential operations running during a disruption.
• A disaster recovery plan (DRP) restores IT systems and data after an event.
• Plans must be documented, owned, communicated, and tested (tabletop, walkthrough, simulation, full failover) - an untested plan routinely fails when needed.

Teaching: Change Management as Governance

CompTIA treats change management as a governance and operations topic because uncontrolled change is a leading cause of both outages and security gaps. A formal change process requires that every change follow approval through a change advisory board, sit within an ownership and stakeholder structure, and carry an impact analysis that weighs what could go wrong. Changes are made inside a scheduled maintenance window, follow standard operating procedures, and always include a backout (rollback) plan so a failed change can be reversed. Test results validate the change before it reaches production.

The exam also lists technical implications of change that security professionals must anticipate: allow and deny lists that must be updated, restricted activities and downtime, the need to restart services or applications, legacy applications that break under change, and dependencies that ripple across systems. Finally, change must be documented - updating diagrams, policies, and procedures and maintaining version control - so the environment's true state is always known. When a scenario describes a change that caused an outage or a security hole, the intended lesson is nearly always that the change management process (approval, testing, or rollback planning) was skipped.

Teaching: Building a Security Awareness and Human-Risk Program

People are simultaneously the largest attack surface and the strongest sensor, so SY0-701 treats security awareness as a governance program, not a one-time video. An effective program runs continuously rather than annually, uses role-based content so developers, executives, and front-line staff each get relevant training, and measures its results. It covers recognizing phishing and social engineering, handling sensitive data correctly, following the acceptable use policy, spotting anomalous behavior, and reporting incidents quickly through a known channel.

The program's centerpiece is often simulated phishing: sending benign lures to staff, measuring click rates, and delivering just-in-time coaching to those who fall for them. Over time, click rates fall and reporting rates rise - a measurable reduction in human risk. Training also addresses insider threat awareness, secure remote and travel practices, password and MFA hygiene, and the risks of shadow IT. The exam frames awareness as a detective and preventive control on the human layer: it prevents some attacks outright and turns users into reporters who detect the ones that get through. When a scenario shows repeated successful phishing despite technical filters, the intended remediation is a stronger, ongoing awareness program combined with MFA - a reminder that technology and human controls work together, and that neither alone is sufficient.

Teaching: Third-Party and Supply-Chain Risk Management

A large share of breaches now arrive through trusted vendors, so SY0-701 gives real weight to third-party risk management. Before engaging a vendor, an organization performs due diligence: reviewing the vendor's security posture, requesting evidence such as audit reports and certifications, and completing a vendor security questionnaire. Penetration testing and the right-to-audit clauses written into contracts let the organization verify claims rather than take them on faith. Supply-chain analysis extends this scrutiny to hardware suppliers, software providers, and the vendor's own subcontractors, because you inherit weaknesses several links down the chain.

The relationship is governed by the agreements from earlier in this chapter - the SLA for service levels, the MSA and SOW for scope, the NDA for confidentiality, the BPA for partnership terms, and the ISA for secure system interconnection. Once a vendor is onboarded, risk management does not stop: ongoing monitoring watches for the vendor's own breaches, expiring certifications, or degraded performance, and periodic reassessment confirms controls still hold. Access granted to third parties follows least privilege and is promptly deprovisioned when the engagement ends. The exam frequently frames a scenario in which a breach originated at a supplier and asks what would have prevented or limited it; the intended answers are the vetting, contractual, and monitoring controls above - the recognition that trusting a partner still requires verifying and containing that trust.