A parent company has two subsidiaries: one delivers government contracts that require a specified government security control baseline, and the other is a commercial retailer with no such obligation. The parent wants a consistent approach to choosing control frameworks. What should PRIMARILY drive framework selection?
Select an answer to reveal the explanation.
Short Explanation
You don't pick shoes by which box is biggest; you pick them for where you're walking. Framework choice follows each business's legal, contractual and business needs, so the government side gets what its contracts demand and the retailer gets what fits retail.
Full Explanation
Control frameworks are tools for meeting requirements, so selection should start from the obligations and objectives each part of the business must satisfy. The government contracting subsidiary is contractually bound to a specified baseline, so that baseline is not optional for it, while the retailer's selection should reflect its own regulatory exposure, such as payment card obligations, and business risks. A consistent approach means using the same selection criteria, not forcing the same framework on both. Choosing the framework with the most controls and applying it everywhere confuses volume with suitability; it would impose cost on the retailer without corresponding risk reduction and might still not satisfy the specific contractual baseline. Following industry peers' choices ignores contractual terms that are binding on this organization, and peers' circumstances may differ. Selecting based on the security team's familiarity optimizes for convenience rather than for obligations and risk, which may leave contractual requirements unmet. Exam caveat: frameworks can be mapped to each other so a common internal control set can serve both subsidiaries where requirements overlap. Operational check: confirm each subsidiary's framework selection is documented with the requirements it satisfies and approved through governance.