CompTIA SecurityX (CAS-005)Governance, Risk and ComplianceEasy
A global technology company is establishing a new data center in a country with stringent data residency and sovereignty laws. The company's CISO wants to ensure that all data stored and processed within this new facility complies with local regulations while maintaining global security standards. Which of the following governance strategies would best address this requirement?
- AImplementing a 'global baseline' approach, applying the highest common security standard across all regions.
- BAdopting a 'global baseline with local override' strategy, allowing local adjustments within defined parameters.
- CDelegating all security and compliance decisions to the local data center management team.
- DEstablishing a 'local-only' strategy, where each data center operates independently with its own security policies.
Show answer & explanationAnswer & explanation
Correct answer: B. Adopting a 'global baseline with local override' strategy, allowing local adjustments within defined parameters.
A 'global baseline with local override' strategy provides a standardized security foundation worldwide while allowing necessary modifications to meet specific local regulatory requirements, such as data residency laws. This balances global consistency with local compliance.
Why the other options are wrong
- A. A global baseline alone might not satisfy all stringent local requirements, leading to non-compliance.
- C. Delegating all decisions locally could lead to inconsistencies, security gaps, or failure to meet global standards.
- D. A 'local-only' strategy would prevent the company from maintaining global security standards and consistent operations.
Global Baseline with Local Override (GBwLO)
A governance strategy that establishes a universal set of security and compliance standards across an organization, while permitting specific deviations or enhancements to meet unique local legal, regulatory, or operational requirements.
- Ensures global consistency in core security posture.
- Provides flexibility for local compliance and operational needs.
- Requires clear definitions of what can be overridden and by whom.
Memory trick: Think globally, act locally for security.