Embedding compliance requirements within operational processes ensures that they are consistently followed and monitored as part of normal business activities. This provides ongoing assurance that legal and regulatory compliance requirements can be met. The other choices are not as effective as embedding compliance requirements within operational processes.
Regulatory compliance involves following external legal mandates set forth by state, federal, or international government2. Compliance requirements may vary depending on the industry, location, and nature of the organization2. Compliance helps organizations avoid legal penalties, protect their reputation, and ensure ethical conduct2.

Section: INFORMATION SECURITY PROGRAM MANAGEMENT

Organization-wide support is best achieved when security is positioned as a business enabler rather than a barrier. Demonstrating how security supports business objectives, protects revenue, and enables innovation fosters executive and cross-functional buy-in across the organization.

Network segmentation limits the ability of attackers to move laterally between systems, effectively reducing the risk of ransomware spreading from one compromised server to others.