Knowledge is Power
BARE METAL CYBERKnowledge is Power

Sitewide Search

Search Bare Metal Cyber

Search exact control and technique identifiers, Cyber Wiki articles, framework records, playbooks, books, podcasts, Academy courses, individual lessons, and BMC Cyber Challenge activities.
The Cybersecurity Guide to Governance, Risk, and Compliance cover

Governance Risk Compliance

The Cybersecurity Guide to Governance, Risk, and Compliance

A practical guide to connecting governance, risk, compliance, controls, assurance, and organizational decision-making.

Wiley2024
View on Amazon

Reading and application plan

Turn the book into a repeatable learning cycle.

Read with a question in mind, use the Cyber Wiki to expand unfamiliar concepts, and convert each major idea into an action, decision, or discussion point.

Five-step cycle

  1. Preview the section

    Scan the chapter or major subject area and write down the question you want the reading to answer.

  2. Read and annotate

    Capture the central claim, important terms, examples, and any decision you would make differently.

  3. Expand the concept

    Open two or three related Cyber Wiki articles to compare terminology, controls, threats, or implementation context.

  4. Apply the lesson

    Use the material in a real scenario, policy discussion, assessment, design review, class activity, or leadership decision.

  5. Review and retain

    Summarize the lesson in your own words and revisit the related concepts that remain uncertain.

This reading plan is Bare Metal Cyber editorial guidance and is separate from the publisher’s official book content.

Inside the book

Major subjects and chapter areas

Governance, Risk Management, and ComplianceThe Landscape of CybersecurityCybersecurity Leadership: Insights and Best PracticesCybersecurity Program and Project ManagementCybersecurity for Business ExecutivesBridging the Gap: Cybersecurity and the Corporate Board of DirectorsRisk ManagementThe NIST Risk Management FrameworkCybersecurity MetricsRisk AssessmentsNIST Cybersecurity FrameworkCybersecurity Frameworks

Continue learning

Explore the related Cyber Wiki.

Direct and course-derived connections come from the existing Bare Metal Cyber catalog. Broader topic links are editorial recommendations, not publisher claims or official framework mappings.

Direct book connection

Cloud Computing

Cloud computing delivers configurable computing resources as on-demand services over a network, with rapid provisioning, measured use, and shared provider infrastructure.

Open article →Direct book connection

Cybersecurity and Information Security

Cybersecurity and information security overlap substantially, but information security centers on protecting information while cybersecurity emphasizes risks arising from connected digital systems and cyberspace.

Open article →Direct book connection

Maximum Tolerable Downtime

Maximum tolerable downtime is the longest disruption a business process can endure before consequences become unacceptable.

Open article →Direct book connection

NIST Cybersecurity Framework

The NIST Cybersecurity Framework organizes cybersecurity outcomes so organizations can understand current capability, identify priorities, communicate risk, and improve over time.

Open article →Direct book connection

NIST SP 800-53

NIST SP 800-53 provides a broad catalog of security and privacy controls that organizations can select, tailor, implement, assess, and monitor according to risk and requirements.

Open article →Direct book connection

People, Process, and Technology

People, process, and technology form an interdependent security system: skilled people make decisions, repeatable processes coordinate work, and technology implements or supports controls.

Open article →Direct book connection

Policies, Standards, and Procedures

Policies state organizational intent, standards define required conditions, and procedures explain how people perform specific work.

Open article →Direct book connection

SAML

Security Assertion Markup Language is an XML-based standard used to exchange authentication and authorization assertions between an identity provider and a service provider.

Open article →Direct book connection

Security Events, Alerts, and Incidents

A security event is an observable occurrence, an alert is a notification that selected activity may need attention, and an incident is an event or series of events that meets defined criteria for harmful or policy-violating impact.

Open article →Related topic

Cybersecurity Risk Management

Cybersecurity risk management connects assets, threats, vulnerabilities, controls, consequences, uncertainty, priorities, and accountable decisions.

Open article →Related topic

Enterprise Risk Management

Enterprise risk management coordinates risk decisions across business objectives, technology, operations, finance, compliance, and cybersecurity.

Open article →Related topic

Cloud Audit Evidence

Cloud audit evidence demonstrates how cloud controls are designed and operating through configuration, logs, assessments, access reviews, provider reports, tickets, approvals, and automated test results.

Open article →