712-50 Question 16
Single answerUnderstand the enterprise information security compliance program and manage the compliance teamA newly appointed CISO at a multinational manufacturing company inherits a fragmented compliance function. Separate teams are independently responding to PCI DSS, ISO/IEC 27001 surveillance audits, privacy regulations, and customer security questionnaires. Business units complain about duplicate evidence requests, inconsistent interpretations of control requirements, and audit fatigue. The board has asked the CISO to improve efficiency without weakening accountability or increasing regulatory risk. Which action should the CISO take FIRST to build an effective enterprise information security compliance program and better manage the compliance team?
- A
Create a centralized compliance governance model with a common control framework, assign clear control ownership, and coordinate evidence collection through a single program office
- B
Increase the size of the compliance team immediately so each regulation and customer audit has dedicated staff with subject-matter expertise
- C
Outsource all compliance activities to an external assessor to ensure objectivity and reduce internal management overhead
- D
Allow each business unit to manage compliance independently, but require monthly status reports to the CISO for oversight
Show answer and explanation
Correct answer: A
Explanation
The best first action is to establish centralized compliance governance supported by a common control framework and clearly assigned control ownership. In practice, mature organizations map requirements from multiple sources, such as PCI DSS, ISO/IEC 27001, privacy laws, contractual obligations, and internal policies, to a unified set of controls. This reduces duplicate testing, streamlines evidence collection, and improves consistency in how requirements are interpreted and assessed. It also enables the CISO to manage the compliance team as an enterprise capability instead of a collection of disconnected specialists.
This approach is consistent with widely accepted security governance and compliance practices. ISO/IEC 27001 emphasizes defined responsibilities, coordinated control implementation, and continual improvement of the information security management system. NIST guidance, including the concept of control baselines and control overlays in frameworks such as NIST SP 800-53, supports mapping multiple requirements to common controls. The U.S. Sentencing Guidelines and common governance models also reinforce the importance of formal oversight, accountability, and monitoring in corporate compliance programs. From a CCISO perspective, the key leadership decision is not merely to process audits faster, but to design a scalable compliance operating model that improves efficiency, preserves accountability, and aligns compliance activities with enterprise risk management.
- A. Correct.
Correct. A centralized governance model built around a common control framework is the most effective first step because it addresses the root cause of duplication and inconsistency. Mapping multiple regulatory, contractual, and standards-based requirements to a shared set of enterprise controls reduces redundant testing and evidence requests, improves consistency of interpretation, and clarifies accountability through defined control owners. A single program office or coordinated compliance function also enables better scheduling, reporting, and issue tracking across the enterprise. This approach aligns with mature governance practices and supports risk-based compliance management rather than siloed checklist execution.
- B. Incorrect.
Incorrect. Adding staff may temporarily improve throughput, but it does not solve the structural problem of fragmented governance, overlapping requirements, or inconsistent control interpretation. Without a unified framework and operating model, more staff can actually increase duplication and complexity. This option reflects the common misconception that compliance inefficiency is primarily a capacity issue rather than a coordination and governance issue.
- C. Incorrect.
Incorrect. External assessors can provide independent validation, specialized expertise, and support during audits, but they should not replace internal ownership of the compliance program. Management remains accountable for compliance, control design, and remediation. Full outsourcing would also weaken institutional knowledge and may not resolve evidence fragmentation across business units. This choice reflects the misconception that objectivity requires transferring program ownership outside the organization.
- D. Incorrect.
Incorrect. Decentralized management with only periodic reporting preserves the very silos that are causing duplicate requests and inconsistent interpretations. Monthly reports may improve visibility for the CISO, but they do not create standardization, a common taxonomy, or enterprise control ownership. This approach is more likely to perpetuate local variation and audit fatigue than to establish a mature enterprise compliance program.