ISC2 CC: Security Governance
The provider lists this domain at 17.3% of the exam.
In plain English
How an organisation organises security as a management job: rules, planning for disruption, teaching people to spot threats such as phishing, and measuring whether it works.
What the provider lists under it
- Governance, risk and compliance: purpose, importance and tools
- Business continuity and disaster recovery
- Security awareness culture
- Measuring effectiveness
Terms worth knowing
- Phishing: A scam message that tricks you into giving up a password, money or access.
- Data governance: The rules and responsibilities for how an organisation manages, protects and uses its data.
Quick answers
How much of the ISC2 CC exam is Security Governance?
The provider lists it at 17.3% of the exam, according to the ISC2 CC exam outline (effective 1 September 2026).
What topics are in Security Governance?
Governance, risk and compliance: purpose, importance and tools; Business continuity and disaster recovery; Security awareness culture; Measuring effectiveness.
The other ISC2 CC domains
- Security Principles (24% of the exam)
- Identity and Access Management (IAM) Concepts (20% of the exam)
- Networking and Cloud Security Concepts (21.3% of the exam)
- Security Operations and Incident Response (17.3% of the exam)
Test yourself
Full-length ISC2 CC practice tests with an explanation for every answer option.
Browse the ISC2 CC practice testsAll domainsDomain names, weights and topic lists come from the ISC2 CC exam outline (effective 1 September 2026), checked 2 November 2026. Providers change their outlines, so confirm the current version before you book. The plain-English explanations are ours, not the provider’s. Not affiliated with, endorsed by or sponsored by any certification vendor or exam body. Certification names, exam codes and product names are trademarks of their respective owners and are used only to identify the exam a practice product prepares for. Our questions are original and are not actual exam questions.