Your company as a Taiwan-based public company decides to start the business of selling toys online and shipping globally. To penetrate the market in the US, your company set up a branch company in the United States. The governance model is centralized; only the decisions that must be compliant with local laws and regulations are delegated to the local branch. The local data retention policy of the US branch is different from the local laws and regulations. As a security professional for the local branch, which of the following is the best action?
A. Review the local data retention policy
B. Suggest the local branch follow the policy of headquarters
C. Request corrective actions to be compliant with the local laws and regulations
D. Revise the local policy to meet the requirements of the local laws and regulations
Kindly be reminded that the suggested answer is for your reference only. It doesn’t matter whether you have the right or wrong answer. What really matters is your reasoning process and justifications.
My suggested answer is A. Review the local data retention policy.
Before taking any action to fix anything, one has to determine if the problem exists. Therefore, it’s a good practice to define the problem and work out a problem statement, then analyze the problem in detail so that alternative solutions can be generated or proposed.
Considering the cost and benefit, you select a solution (some will call it the “strategy”) to implement. In an organization, projects or programs will be initiated to implement the selected solution or strategy.
To elaborate on a policy, an organization may or may not set standards that not only meet but also higher than the requirements of laws and regulations. The data retention policy may be associated with a standard of 7 years retention period that meets the 5 years requirement by the laws or regulations. In this situation, you don’t have to take any corrective actions.
As a result, reviewing the local data retention policy to realize if the policy violates the laws or regulations is the best action.