CompTIA SecurityX (CAS-005)Governance, Risk and ComplianceHard
A multinational corporation is implementing a new global data governance policy. The policy mandates that all data classifications, retention periods, and access controls must be consistently applied across all subsidiaries, regardless of local regulations, unless local laws explicitly require a more stringent control. This approach aims to minimize legal and compliance risks globally. Which regulatory compliance strategy is this scenario best exemplifying?
- AStrict Adherence to Local Laws
- BRisk-Based Compliance Prioritization
- CGlobal Baseline with Local Override (GBwLO)
- DMinimum Viable Compliance
Show answer & explanationAnswer & explanation
Correct answer: C. Global Baseline with Local Override (GBwLO)
The strategy described — applying a global baseline (consistent classifications, retention, access) but allowing local laws to override and impose more stringent controls — is precisely what is known as Global Baseline with Local Override (GBwLO). This ensures a high standard globally while respecting local legal requirements.
Why the other options are wrong
- A. Strict Adherence to Local Laws would imply separate, potentially divergent, policies for each locale, which the global policy aims to avoid by setting a baseline.
- B. Risk-Based Compliance Prioritization focuses on allocating resources to highest risks, not on the specific structure of global policy application.
- D. Minimum Viable Compliance aims for the bare minimum, which is not the goal of applying consistent, potentially stringent, global controls.
Global Baseline with Local Override (GBwLO)
A compliance strategy where a global set of security and data governance controls is established as a baseline, but local regulations can impose more stringent requirements that override the baseline for that specific jurisdiction.
- Ensures consistent global minimum standard.
- Allows for stricter local compliance.
- Balances global efficiency with local legal requirements.
Memory trick: Global baseline for all, but locally, stricter rules override.