In the IIA cybersecurity domains, Domain 1 Governance includes which of the following elements?

• A. Board oversight, strategy alignment, roles, policies, resources, and regulatory oversight
• B. Asset identification, threat assessment, risk appetite, third-party risk, and monitoring
• C. Provide independent assessment, validate controls, identify blind spots, and ensure accountability
• D. Not a penetration testing team, security operations, compliance checkbox service, or breach guarantee

Answer: (A)

Understanding Domain 1 Governance means focusing on how leadership directs and oversees the cybersecurity effort. Governance sets the framework so cybersecurity aligns with business goals, assigns accountability, and ensures compliance. It includes the board’s oversight, ensuring strategy aligns with objectives; clearly defined roles and responsibilities; established policies and standards; adequate resources; and regulatory oversight to keep the program in check.

The best choice captures all these governance elements: board oversight, strategy alignment, roles, policies, resources, and regulatory oversight. These items together establish how the organization directs, funds, and monitors its cybersecurity program and ensures it supports the enterprise.

The other options describe activities outside the governance framework. They cover risk assessment and identification, independent assurance activities, or operational functions, which are related to risk management or assurance rather than the governance structure itself. The last option is not a meaningful governance concept.