CISM Information Security Governance Practice Question

An organization is subject to GDPR, PCI DSS, and SOX. What is the BEST approach to manage compliance with multiple regulations?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Develop a control framework that maps to all regulations

A unified compliance framework that maps common controls to multiple regulations reduces duplication and cost.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Assign each regulation to a separate compliance team
Why it's wrong here
Siloed teams lead to duplication and inefficiency.
✓
Develop a control framework that maps to all regulations
Why this is correct
Developing a unified control framework that maps to GDPR, PCI DSS, and SOX satisfies the constraint of regulatory overlap by enabling a single set of controls to satisfy multiple requirements simultaneously, thereby eliminating redundant audits and reducing compliance friction across all three regimes.
✗
Implement the most stringent requirements for all
Why it's wrong here
This may be overkill and expensive.
✗
Focus only on the regulation with the highest fines
Why it's wrong here
Neglecting other regulations exposes the organization to penalties.

Go deeper