Governance, risk and compliance · Question 11 of 12
A company must comply with ISO/IEC 27001, PCI DSS and NIS2. Each team maintains its own spreadsheets with partly contradictory information on the same controls. What solves the problem best?
1 answer is correct. Hard
Show answer
Answer
- C A common control catalog for all requirements
Explanation
A single control catalog (a "common control framework") avoids duplicated work and contradictions. A control such as multi-factor login is described once, tested once and used as evidence for all requirements. Legal or contractual obligations cannot simply be dropped.