A global group with subsidiaries regulated in several different jurisdictions is deciding whether its information security function should be centralized or federated. What should drive the decision?
Select an answer to reveal the explanation.
Short Explanation
There's no one-size-fits-all org chart for security. Separate regulators, different cultures and different risk levels might push you toward local teams, or a strong central core, or a blend. The trap is assuming a framework hands you the 'right' structure.
Full Explanation
Organizational structure for information security should be chosen to fit the organization's context. A centralized model offers consistency, economies of scale and a single point of accountability, while a federated model places capability closer to business units and can better accommodate local regulators, languages and business practices. For a group with subsidiaries regulated in different jurisdictions, the decision should weigh those regulatory obligations, which may require local accountability or local presence, alongside the group's culture, the risk profile of each subsidiary and the need for group-level oversight. Relying on a model recommended by a framework misunderstands frameworks; widely used security frameworks describe outcomes and controls, and generally do not prescribe a single organizational structure for every enterprise. Minimizing central headcount optimizes for cost and may leave subsidiaries without the oversight or local expertise their regulators expect. Reusing the parent's pre-acquisition model ignores that the group's regulatory and risk landscape has changed. Exam caveat: hybrid models are common, combining central policy and oversight with local implementation. Operational check: map each subsidiary's regulatory requirements for local roles and reporting, then evaluate candidate structures against them and against the group's risk appetite before seeking executive approval.