Which statements about compliance laws and security requirements are true?

• A. Create requirements to which security must respond
• B. Can be expensive for IT security
• C. Both of the above
• D. Neither of the above

Answer: (C)

Compliance laws set the security requirements organizations must meet, translating risk into mandated controls and practices. They specify what needs protection, how data should be handled, and how to prove compliance through documentation and audits. That makes the statement about creating requirements true. At the same time, pursuing compliance often drives costs for IT security—investments in controls, encryption, access management, incident response plans, ongoing monitoring, audits, and staff training add up, and penalties for noncompliance can be significant. This makes the statement about expense true as well. So, both statements are true.