| | APRIL 2025ENTERPRISE SECURITY MAGAZINE8IN MY OPINIONIN MY OPINIONIN MY OPINIONIN MY OPINIONCYBERSECURITY STRATEGY FOR GLOBAL CONSUMER PRODUCTS COMPANY IN CHINA MARKETBy James He, Cyber security Director, L'Oréal (EPA: OR)The world is ever-changing. During the past 20 years, China has become the factory of the world for multiple industries, even for some high-technology industries, through the process of globalization. However, in recent 5 years, China market has becoming more and more unique, even separated from the rest of the world, due to some geo-political reason, high-tech competition, data sovereignty and localization requirement, and end-to-end supply chain security, etc. But the only thing that has not changed is that China is still one of the biggest consumer markets in the world, due to the key factors: population, purchasing power and government policy support for the internal circulation of China's economy. I believe no global consumer product company is willing to give up China market. The only thing we need to study is how to adapt our Chinese organization to this unique market and unique digital world, and the same to our Cybersecurity strategy in China, as a cybersecurity practitioner.First of all, China has its unique and comprehensive cybersecurity law and regulation, including data security and privacy protection. What's our strategy to comply to these requirements while keeping our global strategy and visibility? What kind of bottom line should we hold for both sides? I believe this is the part where cybersecurity, legal, even government affairs need to work very closely, and keep updated of the political climate, understand government's legislation and enforcement trends, even benchmark with industry peers, then we can formulate our own executable compliance strategy and plans. From technical perspective, neither global centralization nor China localization technology and data residency strategy will be fitting for both sides simultaneously, we definitely need to source for an intermediate solution like geographically partitioned or distributed solution to meet China data residency requirement while allowing only necessary aggregated or James He
< Page 7 | Page 9 >