Comprehensive and Detailed Step-by-Step
Option A: Data retention
Data retention refers to the policies and procedures surrounding how long data must be retained to meet regulatory, operational, or business requirements.
This does not describe the CISO's research into compliance regulations.
Option B: Data classification
Data classification involves categorizing data based on its sensitivity or importance (e.g., public, confidential, restricted).
While this is a critical process for compliance, it does not describe researching regulations.
Option C: Due diligence
Correct Answer.
Due diligence is the process of conducting thorough research and analysis to ensure that a company's operations comply with applicable laws, standards, and best practices.
The CISO's action of researching relevant compliance regulations directly aligns with due diligence responsibilities.
This concept is emphasized in the CASP+ objectives under governance, risk, and compliance (GRC), highlighting the need for security leaders to verify compliance requirements during product or service development.
Option D: Reference framework
A reference framework provides guidelines or standards, such as ISO 27001 or NIST frameworks, for structuring security programs.
While the CISO may use a framework during this process, the act of researching regulations is not equivalent to referencing a framework.
Reference:
CompTIA CASP+ Study Guide (Current Edition) - Chapters on GRC and Legal Compliance.
CASP+ Objective 3.2: Integrate enterprise resilience.