Question

A large, multinational company currently has two separate databases. One is used for ERP, while the second is used for CRM. To consolidate services and infrastructure, it is proposed to combine the databases. The company's compliance manager is asked to review the proposal and is concerned about this integration.

Which of the following would pose the MOST concern to the compliance manager?

A. The attack surface of the combined database is lower than the previous separate systems, so there likely are wasted resources on additional security controls that will not be needed.
B. There are specific regulatory requirements the company might be violating by combining these two types of services into one shared platform.
C. By consolidating services in this manner, there is an increased risk posed to the organization due to the number of resources required to manage the larger data pool.
D. Auditing the combined database structure will require more short-term resources, as the new system will need to be learned by the auditing team to ensure all security controls are in place.

Answer 1

The most significant concern for a compliance manager is the potential violation of regulatory requirements when combining ERP and CRM databases, as non-compliance can lead to significant fines and reputation damage.

Step-by-step explanation:

Among the concerns mentioned, the most pressing one for a compliance manager regarding the integration of an ERP (Enterprise Resource Planning) and a CRM (Customer Relationship Management) database would likely be B.

There are specific regulatory requirements the company might be violating by combining these two types of services into one shared platform.

This is because combining databases can lead to complex compliance issues related to data privacy, protection, and the segregation of sensitive information, as mandated by various laws and regulations like GDPR, HIPAA, or Sarbanes-Oxley Act. Such regulatory requirements are stringent, and non-compliance can result in significant fines and reputational damage.

On the contrary, the other options, although they might be concerns from an operational or strategic perspective, do not directly address the stringent legal and compliance implications of combining ERP and CRM systems.