A company has 2 franchises, both of which are a part of the same Salesforce org. The CEO manages both franchises, and should be able to see and communicate with all users. The CEO further needs to ensure other users can only see users from their own franchise. Please provide a comprehensive solution that meets all the above requirements.
This is perfectly possible with at least Enterprise Edition. You'll want to start by setting all sharing settings to private. Then, fashion your role hierarchy so that the CEO is at top, with two branches, one for each organization; assign the appropriate users to the right roles. Create some sharing rules so that each branch has the necessary access to related records. Configure user sharing so that a user in a particular branch can only see other members in their branch.
Setup delegated admins that can reset passwords, etc, for users they can see. No user should have Modify All Data or View All Data, but instead be set to the top level role for the appropriate branch for sharing purposes (use the Hierarchy Sharing feature of the organization wide defaults). At this point, all that's left is to build out page layouts and profiles for the appropriate groups on each side. A properly configured org will appear as two distinct orgs to users that are not the CEO (e.g. they will only see their own data), but will appear as a merged view of both orgs to the CEO.
This type of setup is non-trivial and requires careful planning. If you have any doubts, try contacting a consultant, or engage technical support. They can help with the most basic questions on how to set this up correctly. As noted in comments, users with System Administrator profiles will have full access to all data. Usually this is one or a few limited number of users that are mutually exclusive to either org (in other words, they are isolated from employees of both orgs so that data won't leak), and are trusted not to take advantage of the data in either org. It's also possible to lock down System Administrator users so they can only login from certain locations, or at certain times, to reduce the risk of data loss/theft/corruption/etc.