CISM · Question #36
A multinational organization is introducing a security governance framework. The information security manager's concern is that regional security practices differ. Which of the following should be…
The correct answer is D. Local regulatory requirements. When implementing a security governance framework in a multinational organization with differing regional practices, evaluating local regulatory requirements first is crucial due to their mandatory nature and potential impact on operations.
Question
A multinational organization is introducing a security governance framework. The information security manager’s concern is that regional security practices differ. Which of the following should be evaluated FIRST?
Options
- ATraining requirements of the framework
- BGlobal framework standards
- CCross-border data mobility
- DLocal regulatory requirements
How the community answered
(28 responses)- A11% (3)
- B21% (6)
- C4% (1)
- D64% (18)
Why each option
When implementing a security governance framework in a multinational organization with differing regional practices, evaluating local regulatory requirements first is crucial due to their mandatory nature and potential impact on operations.
Training requirements are important but only after the core framework, which must account for legal obligations, is defined.
While global framework standards are the goal, they must be tailored and implemented in consideration of local legal realities.
Cross-border data mobility is a critical aspect, but its policies and controls are directly influenced by the underlying local regulatory requirements regarding data privacy and residency.
Local regulatory requirements are legally binding and must be complied with; therefore, understanding these varied obligations across different regions is the foundational first step to ensure the security governance framework is compliant and effective globally. Non-compliance can lead to significant legal and financial penalties.
Concept tested: Security governance framework implementation
Source: https://nvlpubs.nist.gov/nistpubs/ir/2007/NIST.IR.7358.pdf
Topics
Community Discussion
No community discussion yet for this question.