Which of the following is the BEST way to ensure that organizational security policies comply with data security regulatory requirements?