A multinational corporation with strict regulatory requirements (e.g., GDPR, PCI-DSS) needs a SIEM solution to monitor its global network. Data residency laws in certain regions prohibit…

Question

Options

• ASelf-hosted, jointly managed
• BHybrid model, jointly managed
• CSelf-hosted, MSSP-managed
• DCloud, MSSP-managed

• A
  13% (3)
• B
  63% (15)
• C
  4% (1)
• D
  21% (5)

Explanation

A hybrid, jointly managed model best satisfies the competing requirements: regional data residency constraints plus centralized monitoring and limited internal SIEM expertise. Hybrid SIEM deployments can keep logs stored and processed within required jurisdictions (for example, regional collectors/workspaces or on-prem storage) while still enabling centralized oversight through federated monitoring, cross-region dashboards, or aggregated metadata that does not violate residency rules. “Jointly managed” addresses the limited expertise by involving a service provider or external specialists alongside internal teams, allowing 24/7 SOC coverage and operational support while maintaining control and governance required by regulations. A fully cloud, MSSP-managed model can conflict with data residency if logs must not leave a region and the cloud tenancy doesn’t meet specific jurisdictional requirements. A self-hosted model reduces residency risk but can fail operationally if internal expertise is limited and 24/7 coverage cannot be sustained. Therefore, a hybrid model jointly managed provides the best balance of compliance, centralized visibility, and operational capability.

No community discussion yet for this question.