Which of the following BEST explains whether the design factors Threat Landscape and Compliance Requirements...

COBIT® 2019 explicitly states that design factors are context-dependent and must be assessed individually for each enterprise. Although both a military defense contractor and a pharmaceutical company operate in regulated environments, the nature, sources, and impact of threats and compliance requirements differ significantly.

A defense contractor faces geopolitical threats, national security regulations, export controls, and classified information risks. A pharmaceutical company, particularly one engaged in genetic research, faces regulatory scrutiny related to clinical trials, patient safety, intellectual property, and ethical compliance.

The Design Guide emphasizes that enterprises operating in different environments will have different threat profiles and compliance drivers, even if both are highly regulated. This difference directly affects governance priorities, focus areas, and capability requirements.

Therefore, the correct explanation is that the design factors would be very different due to the fundamentally different operating environments.