Domain: Corporate Governance
Question:
To prepare for an IPO and ensure a successful SEC Form S-1 filing, Anton & Chia Insurance (Multi-National) Corporation must demonstrate a defensible, metrics-driven information security posture under a principles-based Lloyd's governance framework. The company faces unannounced, on-site regulatory review and must evidence how its controls satisfy both internal governance standards and overlapping external frameworks.

Regulators have selected information security as a focus area and are testing the organization's documentation related to record adequacy, business organization, and the confidentiality, integrity, and security of information. Senior leadership requires clarity on how adequacy is established, which frameworks apply, and whether testing can be leveraged across multiple requirements.

In this context, how should the organization evidence the adequacy of information security using measurable KPIs/KRIs, audits, and risk assessments, while mapping overlapping regulatory frameworks into a single, defensible testing approach? Additionally, how should the organization document and retain evidence showing that one test can satisfy multiple annual compliance obligations, consistent with Lloyd's CEIOPS Advice 3.29?

Expected points in a correct answer:
States that the organization can establish the adequacy of information security by creating relevant metrics.
States that relevant metrics include KRI's.
States that relevant metrics include KPI's.
States that audits over information security processes are part of establishing adequacy of information security
States that risk management assessments over information security processes are part of establishing adequacy of information security
States that information security audits should be effective.
States that information security risk management assessments should be effective.
States that information security audits should be consistent.
States that information security risk management assessments should be consistent.
States that the organization should follow and comply with the guidance provided in all relevant information security frameworks
States that the relevant information security frameworks should be evaluated on an annual basis
States that the results of the assessments should be reviewed by senior management.
States that the areas of assessment should cover all aspects in relation to the Lloyd's principle of adequacy of records.
States that the areas of assessment should cover all aspects in relation to the Lloyd's principle of security of information. (CEIOPS Advice 3.29).
States that multiple frameworks can overlap.
States that one test can satisfy multiple annual requirements.
States that any deficiencies identified by assessments should be remediated.
States that remediation of deficiencies should be completed within the same year
States that senior management should review assessment results, including identified deficiencies and their remediation
States that the organization should retain documentation to evidence the overlap between frameworks and support the use of a single test for multiple requirements.
States that audits and risk management assessments should be performed over information security processes specifically.