A global policy requires that confidential documents be stored only in approved repositories, but a regional office keeps sharing them through personal messaging groups because that is how local teams have always collaborated. What should the security manager do?
Select an answer to reveal the explanation.
Short Explanation
You can change the road without changing the destination. The goal, keeping confidential documents in controlled places, stays put, but you work with the local leaders on how they get there, maybe a sanctioned collaboration tool that feels like what they already use. The trap is thinking it's either 'exempt them' or 'punish them'.
Full Explanation
Policies express management intent and should be applied consistently, but effective implementation depends on understanding the local culture in which people work. When a regional office does not follow a global policy because it conflicts with established collaboration habits, the security manager should engage regional leadership to understand the need behind the behavior and adapt communication, training and supporting tools so the policy's intent is achieved in a locally workable way. A permanent exemption abandons control over confidential data in that region and signals that policy compliance is optional wherever habits differ. Referring managers for discipline before understanding the cause may produce grudging compliance at best and drives the behavior out of sight at worst. Rewriting the global policy to match one region's informal practice weakens protection everywhere and inverts the relationship between policy and practice. Exam caveat: if a local law genuinely conflicts with the global policy, the answer changes to a documented, legally reviewed local variation; here the conflict is with working norms, not law. Operational check: agree a sanctioned collaboration channel with regional leaders, set a transition date, and measure the volume of confidential content leaving approved repositories.