An organization is planning to open a new office in another country. Sensitive data will be routinely sent between two offices. What should be the information security managers FIRST course of action?

A. Identify applicable regulatory requirements to establish security policies. B. Update privacy policies to include the other countrys laws and regulations. C. Apply the current corporate security policies to the new office. D. Encrypt the data for transfer to the head office based on security manager approval.

Correct Answer: A???? or B????????

______________________

Note

The official answer (could be incorrect because NO comes from ISACA!) is: "A. Identify applicable regulatory requirements to establish security policies".

Other experts claim that the correct answer is: "B. Update privacy policies to include the other countrys laws and regulations".

Your expert opinion (and explanation) is strongly requested. Many thanks in advance.