712-50 Question 51
Single answerUnderstand the information security compliance process and proceduresA newly appointed CISO inherits a compliance program that is heavily audit-driven. Internal teams scramble to collect evidence only a few weeks before each annual assessment for PCI DSS, ISO/IEC 27001 surveillance audits, and several customer security reviews. The board has asked the CISO to reduce compliance fatigue while improving assurance that security controls are operating effectively throughout the year. Which action should the CISO take FIRST to mature the information security compliance process and procedures?
- A
Implement a continuous compliance program that maps regulatory and contractual requirements to a common control framework, assigns control owners, and defines periodic evidence collection and testing.
- B
Increase the internal audit frequency from annually to quarterly so that business units are forced to maintain up-to-date documentation.
- C
Purchase a GRC tool immediately and require all compliance activities to be managed through the platform before redesigning the process.
- D
Outsource all compliance assessments to an external consultancy so that independent specialists can collect evidence and prepare the organization for audits.
Show answer and explanation
Correct answer: A
Explanation
The best first action is to shift from episodic, audit-driven compliance to a continuous compliance operating model. In practice, mature programs rationalize overlapping obligations from regulations, standards, and contracts into a unified control framework, then assign clear owners and establish recurring evidence collection, testing, exception handling, and reporting. This reduces duplicate work across obligations such as PCI DSS, ISO/IEC 27001, and customer questionnaires while giving leadership better visibility into control effectiveness throughout the year. This approach is consistent with generally accepted governance and compliance practices reflected in ISO/IEC 27001's emphasis on monitoring, measurement, internal audit, and continual improvement, as well as NIST guidance on ongoing assessment and continuous monitoring. Tools and external assessors can be valuable enablers, but they should support a well-defined compliance process rather than substitute for it.
- A. Correct.
Correct. This addresses the root problem: a reactive, point-in-time compliance approach. A continuous compliance model aligns multiple obligations to a common set of controls, reduces duplicated effort across frameworks, assigns accountability to control owners, and establishes recurring evidence collection and control testing. This is the most effective first step to improve both efficiency and assurance. It reflects recognized best practices in compliance management and control monitoring, including the use of control rationalization and ongoing assessment rather than audit-season preparation.
- B. Incorrect.
Incorrect. More frequent audits may increase pressure on business units, but they do not by themselves fix fragmented control ownership, duplicated evidence requests, or the lack of an integrated compliance process. This option treats the symptom rather than the cause and may actually worsen compliance fatigue.
- C. Incorrect.
Incorrect. A GRC platform can support workflow, evidence management, and reporting, but technology should follow process design. Buying a tool before defining the control framework, ownership model, testing cadence, and evidence requirements often leads to poor adoption and automating inefficient practices.
- D. Incorrect.
Incorrect. External consultants can help with readiness reviews or specialized assessments, but outsourcing does not create internal accountability or sustainable compliance procedures. The organization still needs a defined compliance process, control ownership, and ongoing monitoring capability. Overreliance on consultants can also increase cost and reduce institutional knowledge.