The focus of Domain 1 Governance is best described as:

• A. Board oversight, strategy alignment, roles, policies, resources, and regulatory oversight
• B. Asset identification and threat assessment
• C. Risk monitoring only
• D. Breach guarantee programs

Answer: (A)

Governance focuses on setting direction and accountability for cybersecurity across the organization. It involves board oversight and executive sponsorship, ensuring the cybersecurity strategy is aligned with business objectives, clearly defining roles and responsibilities, establishing policies and standards, securing the necessary resources, and meeting regulatory and legal requirements. This breadth captures how governance creates the framework within which risk management and controls are designed, implemented, and overseen, rather than focusing solely on technical analysis or isolated activities.

Asset identification and threat assessment describe figuring out what to protect and what threats exist, which is more about risk identification than governance leadership. Risk monitoring alone is too narrow, since governance encompasses strategy, policy, resource allocation, and compliance—not just watching risk levels. Breach guarantee programs relate to risk transfer or incident response/insurance, not the overarching governance structure.