Question

A business is growing and starting to branch out into other locations. In anticipation of opening an office in a different country, the Chief Information Security Officer (CISO) and legal team agree they need to meet the following criteria regarding data to open the new office:

✑ Store taxation-related documents for five years
✑ Store customer addresses in an encrypted format
✑ Destroy customer information after one year
✑ Keep data only in the customer's home country

Which of the following should the CISO implement to BEST meet these requirements? (Choose three.)

A. Capacity planning policy
B. Data retention policy
C. Data classification standard
D. Legal compliance policy
E. Data sovereignty policy
F. Backup policy
G. Acceptable use policy
H. Encryption standard

Answer 1

B. Data retention policy

C. Data classification standard

E. Data sovereignty policy

The Chief Information Security Officer (CISO) should implement the data retention policy to store documents and destroy customer information, the data classification standard to encrypt customer addresses, and the data sovereignty policy to keep data in the customer's home country.

Step-by-step explanation:

The CISO should implement the following policies to meet the specified requirements:

1. Data retention policy: This policy will outline the guidelines for storing taxation-related documents for five years and destroying customer information after one year.
2. Data classification standard: This standard will ensure that customer addresses are stored in an encrypted format.
3. Data sovereignty policy: This policy will dictate that data must be kept only in the customer's home country.

In addressing the criteria for a business expanding into a new country as outlined by the Chief Information Security Officer (CISO), the following would best meet the data management requirements:

Data retention policy - This ensures that taxation-related documents are stored for the required period of five years.

Encryption standard - This would secure customer addresses in an encrypted format, as required by the company's data privacy guidelines.

Data sovereignty policy - This policy ensures that data is kept only in the customer\u2019s home country, aligning with local data protection laws and regulations.

Together, these policies and standards help the company comply with cyber data issues with privacy, adhere to legal compliance, and protect against data breaches,

which are critically important in the modern digital landscape, especially with the stringent regulations like the GDPR that mandate strict data protection measures.