CISM Information Security Program Practice Question
A multinational organization needs to comply with GDPR and CCPA. What is the best approach for the information security program?
⚠ Common exam trap
ISACA often tests the misconception that 'most restrictive' is always best, but the trap here is that regulatory compliance requires a tailored, risk-based approach rather than a blanket adoption of the strictest rule, which can lead to inefficiency and non-compliance with specific regional obligations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a unified privacy framework covering all regulations
A unified privacy framework (e.g., ISO/IEC 27701 or NIST Privacy Framework) allows the organization to map overlapping requirements from GDPR and CCPA into a single set of controls, reducing duplication and ensuring consistent data protection across jurisdictions. This approach leverages common principles like data minimization, consent management, and breach notification, which are foundational to both regulations, while accommodating specific differences such as GDPR's 72-hour breach notification versus CCPA's broader definition of personal information.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Implement a unified privacy framework covering all regulations
Why this is correct
A unified privacy framework maps overlapping GDPR and CCPA obligations onto shared controls, avoiding duplicated or conflicting processes across jurisdictions. This satisfies the stem's multinational compliance constraint by establishing common data-subject rights, retention and breach-notification procedures that can be extended to additional regulations as they emerge.
- ✗
Adopt the most restrictive requirements from any regulation
Why it's wrong here
GDPR and CCPA impose differing obligations, so blanket adoption of the strictest clause from either can conflict with the other's lawful-processing or retention rules. It is tempting because a single maximum baseline appears to guarantee compliance everywhere, and it would suit a programme operating in one jurisdiction with layered statutes.
- ✗
Outsource compliance to a third-party provider
Why it's wrong here
Outsourcing compliance transfers operational tasks but leaves the organisation accountable for GDPR and CCPA obligations, and a single provider rarely satisfies both regimes. It is tempting because third parties offer specialist expertise, yet accountability and cross-border data handling remain in-house responsibilities.
- ✗
Create separate security programs for each region
Why it's wrong here
Separate regional programs duplicate controls and cannot demonstrate consistent protection for cross-border processing that both GDPR and CCPA govern. It tempts because local tailoring eases regional interpretation, and would be correct where regulations genuinely conflict irreconcilably rather than overlapping.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 924-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.