Explanation
When creating a security policy for a global organization subject to varying laws and regulations, it is important to consider the unique legal and cultural requirements of each location. The best approach is to establish baseline standards for all locations and then add supplemental standards as required to meet local laws and regulations. This approach ensures that the organization is in compliance with all relevant laws and regulations, while also maintaining a consistent and unified approach to security across all locations.
Additionally, by establishing baseline standards, the organization can ensure that its security policies are aligned with its overall security strategy and objectives.

Explanation
Self-assessments provide the best feedback on readiness and permit identification of items requiring remediation. Directing regulators to a specific person or department, or assessing previous reports, is not as effective. The legal department should review all formal inquiries but this does not help prepare for a regulatory review.

An information security manager has to impress upon the human resources department the need for security awareness training for all employees. Budget considerations are more of an accounting function. The human resources department would become involved once they are convinced for the need of security awareness training. Recruiting lT-savvy staff may bring in new employees with better awareness of information security, but that is not a replacement for the training requirements of the other employees. Periodic risk assessments may or may not involve the human resources department function.

Section: INCIDENT MANAGEMENT AND RESPONSE