A global company wants one security policy while respecting differing local obligations. What is the best approach?

1. Choose the policy with the shortest text
2. Let every office abandon enterprise policy entirely
3. Define an enterprise baseline with governed jurisdiction-specific requirements and exceptions
4. Assume the least restrictive jurisdiction applies everywhere