Governance and policy controls shape how people are allowed to act in a system. The description points to the layer that sets the rules, permissions, and enforcement mechanisms guiding user behavior—what users can do, under what circumstances, and how violations are detected and handled. This includes security policies, acceptable use policies, access control policies, and incident response procedures. These governance elements translate risk decisions into concrete controls implemented across people, processes, and technology. The other layers focus on different aspects: a user layer centers on the people and their roles; a network layer handles connectivity and data flow; an application layer covers software functionality. So the rules and management controls that govern user actions fit the policies layer.

Risk management is an ongoing cycle. After you identify threats and assess or evaluate the risks, the final step is to monitor and review. This phase keeps the process alive by tracking how well the controls are working, spotting any new or changing threats, and updating the risk assessment or treatment plan as needed. It effectively closes one cycle and can trigger the next, ensuring the organization stays protected over time. The other steps occur earlier in the process: identifying threats happens at the outset, assessment and evaluation are the analytical work that determines risk levels, and determining a cost-effective strategy is about choosing which controls to implement based on cost-benefit before those controls are put in place and monitored.

IP addresses identify networks and hosts and are used by routers to forward packets from source to destination. This is a network layer function, where addressing is logical and scalable across different networks. At this layer, protocols like IP and ICMP handle addressing and routing decisions, while Layer 2 handles the actual local delivery with MAC addresses. The interaction between layers, such as using ARP to map an IP address to a MAC address on a local network, illustrates how IP (Layer 3) sits above the data link layer. Therefore, the IP address is associated with Layer 3.

System and application logs with their event timestamps are digital traces that capture actions, access attempts, and system states as they happen. These logs come from operating systems, applications, and network devices, recording who did what, when, and from where. The timestamps are critical because they let investigators build an accurate timeline of events, correlate actions across multiple systems, and identify anomalies such as logins at odd times, unusual file access, or strange network activity. Because logs are generated automatically and stored in digital form, they are a go-to source of evidence in most investigations. Printed manuals, employee vacation schedules, and hardware warranty papers are primarily physical or HR records, not digital traces of activity. They don’t automatically reflect system or user activity and typically don’t provide the time-ordered actions investigators need to reconstruct events.