Which statement best describes the relationship between company policy and regulations?

• A. Company policy always matches regulatory language
• B. Company policy may exceed regulatory requirements but may never be less restrictive than regulations
• C. Company policy disregards regulations
• D. Company policy is unrelated to regulations

Answer: (B)

Regulatory requirements set minimum standards that must be followed. Company policy can go beyond those minimums to reinforce protections or reflect how the organization actually operates, but it can never be less restrictive than what regulations require. If a regulation requires certain controls or protections, the policy must meet or exceed that level; it cannot permit looser rules.

For example, if data protection regulations require encryption, a compliant policy might require encryption at rest and in transit and additional access controls, with potential extra safeguards. It could also impose stricter data retention or training requirements, but it cannot allow unencrypted data or weaker controls.

Saying the policy always mirrors regulatory language, disregards regulations, or is unrelated to regulations would miss the practical relationship: policy is built to satisfy and, where appropriate, strengthen regulatory requirements.