CompTIA SecurityX (CAS-005)Governance, Risk and ComplianceMedium
A multinational corporation is developing a new cloud-based platform for processing sensitive customer data across various regions. The legal team is concerned about complying with a patchwork of global data privacy regulations, such as GDPR, CCPA, LGPD, and others. To streamline compliance efforts and reduce overhead, which approach should the security architect recommend?
- AAdopt the most stringent regulation (e.g., GDPR) as the global standard for all operations.
- BDevelop a harmonized set of security controls and policies that satisfy the requirements of multiple regulations.
- CImplement separate, distinct security controls for each regulation in every region.
- DOutsource all compliance responsibilities to third-party legal firms in each region.
Show answer & explanationAnswer & explanation
Correct answer: B. Develop a harmonized set of security controls and policies that satisfy the requirements of multiple regulations.
Harmonized compliance involves developing a unified set of controls and policies that simultaneously meet the requirements of multiple regulations. This approach reduces complexity and overhead compared to managing distinct compliance efforts for each regulation, making it the most efficient and effective strategy for a multinational corporation facing various data privacy laws.
Why the other options are wrong
- A. Adopting the most stringent regulation might not cover all unique aspects of other regulations and could lead to unnecessary over-compliance and cost.
- C. Implementing separate controls for each regulation is inefficient and increases complexity and overhead.
- D. Outsourcing compliance responsibilities without internal strategy is costly and doesn't address the architectural challenge of designing a compliant platform.
Harmonized Compliance
A strategy to meet multiple regulatory requirements through a single, integrated set of controls and policies.
- Reduces complexity and cost in multi-jurisdictional environments.
- Focuses on identifying commonalities across regulations.
- Requires thorough understanding of all applicable laws.
Memory trick: Harmonize to simplify, don't individualize to multiply.