Over the past year, several new regulations affecting the organization were missed until external auditors raised them. What is the BEST long-term remedy?
Select an answer to reveal the explanation.
Short Explanation
If you keep finding out about new laws from the auditors, your radar's broken, not your memory. Fixing this year's list is a patch; you want a standing process that keeps scanning and feeds what it finds into your strategy. The trap is relying on the auditors to be your early-warning system.
Full Explanation
Identifying legal, regulatory and contractual requirements is an ongoing management responsibility, not a one-time exercise. When new obligations are repeatedly discovered only through audit, the organization lacks a process to monitor the regulatory landscape and translate changes into security requirements. The best long-term remedy is to establish such a process jointly with legal and compliance, assigning responsibility for horizon scanning, applicability analysis and communication, and ensuring that identified requirements feed the information security strategy, risk assessments and policy updates. Engaging auditors more often outsources detection to a function whose role is independent assurance, adds cost and still finds issues after the fact. Adding the specific regulations to this year's checklist resolves the current findings but does nothing to prevent the next one being missed. Assigning regulations to IT with quarterly attestations places business compliance obligations on a technical function, covers only regulations already known and does not address discovery of new ones. Exam caveat: the security manager does not need to interpret every law personally, but must ensure there is a reliable mechanism to learn about and act on them. Operational check: confirm a regulatory change log exists, with owners, review dates and links to resulting strategy or policy actions.