nerdexam
Isaca

CGEIT · Question #267

The board of directors has mandated the use of geolocation software to track mobile assets assigned to employees who travel outsid of their home country. To comply with this mandate, the IT steering…

The correct answer is C. an assessment to determine if data privacy protection is addressed. Given a mandate for geolocation tracking, the IT steering committee's first priority must be to assess data privacy implications, especially for international travel, to ensure compliance with relevant regulations.

Submitted by klara.se· Apr 18, 2026Risk Optimization

Question

The board of directors has mandated the use of geolocation software to track mobile assets assigned to employees who travel outsid of their home country. To comply with this mandate, the IT steering committee should FIRST request

Options

  • Athe inclusion of mandatory training for remote device users.
  • Ban architect ral review to determine appropriate solution design.
  • Can assessment to determine if data privacy protection is addressed.
  • Dan update to the acceptable use policy.

How the community answered

(44 responses)
  • A
    5% (2)
  • B
    11% (5)
  • C
    80% (35)
  • D
    5% (2)

Why each option

Given a mandate for geolocation tracking, the IT steering committee's first priority must be to assess data privacy implications, especially for international travel, to ensure compliance with relevant regulations.

Athe inclusion of mandatory training for remote device users.

While training is important for user awareness, it is secondary to ensuring the legality and ethical compliance of the tracking solution itself.

Ban architect ral review to determine appropriate solution design.

An architectural review is important for technical implementation, but it should follow the initial assessment of legal and privacy requirements, which could fundamentally impact design choices.

Can assessment to determine if data privacy protection is addressed.Correct

Tracking employee location, especially across international borders, introduces significant data privacy and legal compliance concerns (e.g., GDPR, local privacy laws). Before implementing any solution or policy, it is critical to assess these privacy implications to mitigate legal risks and protect employee data.

Dan update to the acceptable use policy.

An acceptable use policy update is necessary, but it must be informed by a thorough understanding of privacy requirements and the legality of the tracking, making the privacy assessment a prior step.

Concept tested: IT Governance Data Privacy Compliance

Source: https://gdpr-info.eu/

Topics

#Data Privacy#Regulatory Compliance#Risk Assessment#IT Steering Committee

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CGEIT Practice