Build the hierarchy, review the draft, classify the controls, map the frameworks
Governance questions on every security exam assume you can tell a policy from a standard, a deterrent from a preventive control, and Govern from Identify - and real governance work is doing exactly that, line by line. Sort the statements, mark up a draft policy, classify a control library and map an AI control set to NIST CSF 2.0, ISO/IEC 27001 themes and the AI-specific ISO guidance.
Ten statements pulled from a housing trust's document library, all filed in the wrong place. Sort each into policy, standard, procedure, guideline or baseline - the hierarchy every governance exam assumes you know cold.
A draft remote access policy lands on your desk for approval. Click every line that would fail review - untestable wording, detail that belongs in a standard, no owner, a conflict with another policy - and leave the sound ones alone.
Eight controls from a freight company's control library. Classify each by type, by category and by ISO/IEC 27001:2022 Annex A theme - including the compensating control an auditor is about to question.
An insurer's AI controls need mapping before the board meets: to NIST CSF 2.0 functions, to ISO/IEC 27001 themes, and to the right AI guidance - the AI management system standard or the guidance on AI-specific security threats.