A financial institution is expanding to international jurisdictions and is mindful of protecting customer information. Which of the following should be of GREATEST concern?

While important, monitoring and enforcing security controls is an operational challenge that arises *from* the need to comply with specific laws and regulations.

Global PCI regulations apply specifically to payment card data, but customer information encompasses a broader set of data protected by general privacy laws.

Privacy laws and regulations, such as GDPR or various national data protection acts, explicitly govern how customer information must be collected, stored, processed, and protected in each country, carrying significant legal and financial penalties for non-compliance. These laws directly impact the organization's ability to operate legally and maintain customer trust internationally.

Resource availability is a practical consideration for implementing security but doesn't define the *legal mandate* for protecting customer information.