A Dutch company requests to be listed on the American Stock Exchange. Which legislation within the scope of information security is relevant in this case?

Question

Options

• APublic Records Act
• BDutch Tax Law
• CSarbanes-Oxley Act
• DSecurity regulations for the Dutch government

• A
  5% (2)
• B
  8% (3)
• C
  84% (31)
• D
  3% (1)

Explanation

Sarbanes-Oxley (SOX) applies here because any company - regardless of nationality - that lists on a U.S. stock exchange must comply with U.S. federal law, and SOX specifically mandates strict controls over financial reporting and IT systems that support it, making it directly relevant to information security governance.

Why the distractors are wrong:

• A (Public Records Act): This governs government transparency and citizen access to public documents - unrelated to stock exchange listings or corporate IT security.
• B (Dutch Tax Law): Domestic Dutch taxation rules have no bearing on U.S. exchange requirements or information security obligations.
• D (Dutch government security regulations): These apply to Dutch public-sector entities, not to a private company seeking a foreign stock listing.

Memory tip: Think "foreign company, American exchange = American rules apply." SOX is the go-to U.S. law for Stock exchange + Oversight of IT controls + X (cross-border - it doesn't matter where you're from). If a company touches a U.S. exchange, SOX follows.

No community discussion yet for this question.