Which report should a compliance officer generate to understand how the company is complying with data security policies over time?

Which report should a compliance officer generate to understand how the company is complying with data security policies over time?

• A. Policy report, filtered on date and summarized by policy
• B. User activity report by department
• C. Incident report by severity
• D. Data inventory report by data type

Answer: (A)

To understand how the company is complying with data security policies over time, you want a report that tracks adherence to each policy across different time periods. A policy report filtered on date and summarized by policy does exactly that. It shows how well each policy is being followed, how compliance changes over days, weeks, or months, and where gaps or improvements occur. This gives the compliance officer a clear view of trends, enabling timely actions, audits, and demonstrations of ongoing governance. Other options don’t focus on policy adherence over time. A user activity report by department reveals who did what, not whether policies were followed. An incident report by severity highlights incidents but doesn’t show longitudinal policy compliance. A data inventory report by data type shows what data exists, not whether security policies are being applied to that data over time.

To understand how the company is complying with data security policies over time, you want a report that tracks adherence to each policy across different time periods. A policy report filtered on date and summarized by policy does exactly that. It shows how well each policy is being followed, how compliance changes over days, weeks, or months, and where gaps or improvements occur. This gives the compliance officer a clear view of trends, enabling timely actions, audits, and demonstrations of ongoing governance.

Other options don’t focus on policy adherence over time. A user activity report by department reveals who did what, not whether policies were followed. An incident report by severity highlights incidents but doesn’t show longitudinal policy compliance. A data inventory report by data type shows what data exists, not whether security policies are being applied to that data over time.