Which description correctly defines Domain 1 Governance?

• A. Board oversight, strategy alignment, roles, policies, resources, and regulatory oversight
• B. Asset identification, threat assessment, risk appetite, third-party risk, and monitoring
• C. Providing independent assessment and validating controls
• D. Penetration testing and breach guarantees

Answer: (A)

Governance in a cybersecurity program is about setting the direction, priorities, and accountability at the highest level. It involves board or senior leadership oversight, ensuring cybersecurity strategy aligns with business goals, clearly defining roles and responsibilities, establishing policies and controls, securing adequate resources, and monitoring regulatory and compliance obligations. This description matches Domain 1 Governance because it covers oversight, strategy alignment, policies, resource allocation, and regulatory oversight—all at the governance level that guides the entire program.

The other concepts inhabit different areas: asset identification and threat guidance, risk appetite, third-party risk, and ongoing monitoring relate to risk management and operational controls; providing independent assessment and validating controls corresponds to assurance or audit functions; and penetration testing with breach guarantees describes technical testing and incident-related activities, not governance.