Which practice describes coordinating security controls to meet regulatory requirements?

• A. Fragmented controls
• B. Informal processes
• C. Formal governance frameworks
• D. Isolated compliance

Answer: (C)

Coordinating security controls to meet regulatory requirements relies on a formal governance framework that centralizes policy, roles, and processes across the organization. This kind of framework provides structure for how controls are designed, implemented, and continuously monitored, ensuring they map directly to regulatory obligations and can be demonstrated in audits. It establishes a clear governance body, defined responsibilities, policy lifecycles, risk management, control mapping, and change management, so security and compliance work are not done in isolation but as an integrated program. With this approach, evidence, traceability, and accountability are built in, making it easier to stay compliant as regulations evolve and the business changes.

Fragmented controls lack a single coordinating mechanism, so implementations can diverge between departments. Informal processes rely on ad-hoc actions without standardized documentation or oversight. Isolated compliance focuses on checking a narrow set of requirements without aligning them to a coordinated, enterprise-wide strategy. Formal governance frameworks avoid these pitfalls by creating an auditable, repeatable, and scalable approach to meet regulatory demands.