How does a company demonstrate consistent application of security controls at multiple sites?

• A. By centralizing control to a single site only.
• B. By using audits conducted by external agencies without internal standards.
• C. By standardizing policies and procedures, conducting site-specific risk assessments, and maintaining uniform training and documentation.
• D. By applying different security policies at each site with no shared documentation.

Answer: (C)

Consistent application across multiple sites comes from using a single, uniform framework that everyone follows. Standardizing policies and procedures establishes the common rules all sites must adhere to, while site-specific risk assessments tailor those rules to local conditions without changing the underlying framework. Maintaining uniform training and documentation ensures that personnel at every location understand and implement the same controls, and that there is a consistent record for verification and audits. Put together, these elements create a uniform security posture across the entire network, which is essential for programs like CTPAT. Relying on a single site for control, or letting external audits substitute internal standards, or allowing different policies with no shared documentation, would undermine consistency and make it hard to demonstrate across-site security.