712-50 Question 48
Single answerA newly appointed CISO is integrating several regional business units into a single enterprise compliance program. The organization must satisfy regulatory obligations, pass upcoming external audits, and decide which assurance activities should be prioritized to reduce repeat audit findings. Internal reviews show that each business unit interprets control requirements differently, keeps inconsistent evidence, and treats certification efforts as one-time projects. Which action should the CISO take FIRST to build a sustainable compliance capability across the enterprise?
- A
Establish a centralized compliance governance structure with a common control framework, clear control owners, evidence standards, and a recurring control assessment process
- B
Begin pursuing multiple certifications immediately so the organization can demonstrate compliance to regulators and customers as quickly as possible
- C
Rely on each regional business unit to maintain its own compliance process since local teams best understand their regulatory environment
- D
Focus primarily on remediating the findings from the last external audit because clearing prior findings is the fastest way to improve compliance posture
Show answer and explanation
Correct answer: A
Explanation
The best first step is to create a sustainable enterprise compliance capability, not to chase audits or certifications in isolation. In this scenario, the main risks are fragmented control interpretation, inconsistent evidence, and a project-based mindset toward certification. A CISO should establish centralized compliance governance, adopt a unified control framework or control library, define ownership and accountability, normalize evidence requirements, and implement a recurring assessment cycle. This allows the organization to map multiple regulatory, audit, and certification obligations to a common set of controls and test them consistently.
This approach aligns with widely accepted practices from ISO/IEC 27001, which emphasizes an information security management system with defined responsibilities, documented processes, and continuous improvement; NIST guidance, which promotes control baselines, ongoing assessment, and monitoring; and common audit principles requiring repeatable evidence and clearly assigned accountability. Certifications and external audits are valuable outputs of a mature compliance program, but they should be supported by standardized governance and operationalized controls rather than treated as standalone goals.
- A. Correct.
Correct. The core issue is not simply missing fixes for isolated findings, but inconsistent interpretation, ownership, and evidence management across the enterprise. A centralized governance structure supported by a common control framework enables harmonization of regulatory and certification requirements into standard enterprise controls. Assigning control owners, defining evidence requirements, and implementing recurring assessments creates an operating model for ongoing compliance rather than point-in-time audit preparation. This is consistent with common governance and compliance best practices reflected in frameworks such as ISO/IEC 27001, NIST SP 800-53, and the three-lines governance model.
- B. Incorrect.
Incorrect. Certifications can support assurance and market trust, but they do not replace an enterprise compliance operating model. Treating certification as the first priority often reinforces a checkbox approach and may fail if control ownership, evidence collection, and governance are weak. A mature organization typically maps certification requirements into existing controls rather than launching multiple certification efforts before standardizing compliance processes.
- C. Incorrect.
Incorrect. While regional knowledge is important, leaving each business unit to define its own process is the problem described in the scenario. This approach increases inconsistency, duplicated effort, conflicting control interpretations, and difficulty during enterprise-wide audits. Local regulatory nuances should be addressed through control overlays or localized procedures, not separate unmanaged compliance programs.
- D. Incorrect.
Incorrect. Remediating prior audit findings is necessary, but it addresses symptoms more than root causes. If the enterprise continues to lack standardized control ownership, evidence expectations, and recurring assessments, similar findings are likely to reappear. Audit remediation should be managed within a broader compliance program, not as the first and only strategic action.