ISC2 CISSP (Certified Information Systems Security Professional)Asset SecurityHard
A global pharmaceutical company is undergoing a divestiture, separating a division into a new independent entity. This division holds critical intellectual property (IP) and patient data. During the data transfer process, what is the MOST important consideration regarding the handling of this data to ensure legal and regulatory compliance for both entities?
- AVerifying the completeness and integrity of all transferred data.
- BEstablishing clear data ownership and responsibilities for the new entity.
- CImplementing strong encryption for data in transit and at rest.
- DEnsuring the fastest possible transfer speed to minimize downtime.
Show answer & explanationAnswer & explanation
Correct answer: B. Establishing clear data ownership and responsibilities for the new entity.
While transfer speed, integrity, and encryption are crucial operational and security controls, the MOST important consideration for legal and regulatory compliance during a divestiture involving sensitive data is establishing clear data ownership and responsibilities. Without this, neither entity can properly fulfill its obligations regarding data protection, privacy, and regulatory reporting.
Why the other options are wrong
- A. Completeness and integrity are vital for data quality but secondary to ownership for compliance.
- C. Encryption is a critical security control, but ownership dictates who is responsible for implementing and managing it.
- D. Transfer speed is an operational concern, not the primary compliance factor.
Data Ownership in Divestitures
The critical process of clearly defining who is accountable for specific data assets, their protection, and compliance obligations when an organization splits or transfers assets.
- Essential for legal and regulatory compliance.
- Determines responsibility for data protection.
- Impacts privacy obligations and reporting.
Memory trick: When you Split, Ownership's the First Bit.