Security+ Domain 5 · SY0-801
Governance, risk and compliance: the documents that direct security, managing risk and vendors, compliance and privacy obligations, audits and testing, and security awareness.
Each block is as wide as that domain’s share of SY0-801. Domain 5 is 14%, down from 20% in SY0-701. Weights: CompTIA’s published SY0-801 exam objectives (v2.0).
The six objectives
Six objectives on how a security program is run and checked. Most of them ask you to explain or summarize; awareness training (5.6) is scenario-based.
Telling policies, standards, procedures and guidelines apart, the security policies most organizations need, and reference material such as playbooks, benchmarks and advisories.
Typical question: what a document contains, and you name its type or decide which one to create or update.
Identifying and analyzing risk, the risk register and its owners, appetite and tolerance, treatment strategies, residual risk and simple loss calculations.
Typical question: a risk decision or register entry, and you name the strategy or concept that applies.
Assessing, choosing, contracting and monitoring vendors: solicitation documents, due diligence, assessments and attestations, agreements and service levels, and limits such as lock-in.
Typical question: a procurement or vendor-oversight situation, and you pick the document, agreement or assessment that fits.
What effective compliance looks like: reporting and monitoring, the consequences of failing, compliance training, and privacy obligations such as consent, data subject rights and legal holds.
Typical question: an obligation, request or consequence, and you name the compliance element or right that applies.
How organizations check their security: internal and external audits, evidence gathering, gap analysis, penetration testing, and frameworks for describing intrusions such as MITRE ATT&CK, the Cyber Kill Chain and the Diamond Model.
Typical question: what an analyst or auditor is doing, and you name the activity or framework that fits.
Choosing training types and delivery methods, targeting the right topics, and measuring whether the program works.
Typical question: results from a phishing campaign or a pattern of risky behavior, and you pick the awareness action that BEST addresses it.
Objective titles and summaries are our own words, not CompTIA’s. See every objective in the Security+ exam objectives checklist.
Domain test
25 questions in 25 minutes, covering all six objectives, with one PBQ. Your results show how you did on each objective, so you know what to drill next.
Security Program Management and Oversight, every objective, on a timer.
SY0-801 vs SY0-701
Domain 5 loses six percentage points, the biggest weight change in SY0-801, but keeps all six objectives. Threat-intelligence frameworks join audits in 5.5, while data protection roles move out to 3.3 and recovery metrics to 3.4.
SY0-701SY0-801
| SY0-801 | What it covers | From SY0-701 | Change |
|---|---|---|---|
5.1 | Governance, risk and compliance artifacts | 5.1 | Reworded |
5.2 | Risk management processes | 5.2 | Reworded |
5.3 | Third-party risk | 5.3 | Reworded |
5.4 | Security compliance | 5.4 | Same title |
5.5 | Audits and assessments, including ATT&CK and the Kill Chain | 5.5 | Reworded |
5.6 | Security awareness | 5.6 | Reworded |
CompTIA says its lists of examples aren’t exhaustive, so don’t forget the terms it no longer names, but don’t make them your focus. Read the full SY0-801 vs SY0-701 guide.
More practice
Domain 5 questions also appear in every full mock test, weighted the way the exam weights them.
A free, full-length practice exam with 13 Security Program Management and Oversight questions among its 90, each explained option by option.
See how the test player works, from the timer and flags to the explanations, in about ten minutes.
FAQ
Domain 5, Security Program Management and Oversight, covers governance, risk and compliance: policies and standards, risk management, third-party risk, compliance and privacy, audits and assessments, and security awareness. It’s 14% of SY0-801 and has six objectives.
14%, down from 20% in SY0-701, the biggest drop of any domain. Some content moved rather than disappeared: data protection roles now sit in objective 3.3, and recovery metrics such as RTO and RPO in 3.4.
Yes. SY0-801 names MITRE ATT&CK, the Cyber Kill Chain and the Diamond Model in objective 5.5. Expect to be told what an analyst is doing and asked which framework fits, so learn what each one is used to describe.
Be ready for simple loss calculations. Annualized loss expectancy (ALE) is the single loss expectancy (SLE) multiplied by the annualized rate of occurrence (ARO). Our questions keep it to one multiplication; CompTIA’s objectives list the terms without saying how much math to expect.
Take the timed Domain 5 test, or start with Mock Test 1: a free, full-length Security+ practice exam, explained option by option.
