CISM: Certified Information Security ManagerDemo

Question

An organization is developing an agreement with a cloud provider. Who should establish the third party’s destruction schedule for the organization’s information?

A The organization's information security manager
B The cloud provider's information security manager
C The organization's data owner
D The cloud provider's data custodian

Explanation

The organization’s data owner is accountable for defining information-handling requirements, including retention periods and secure destruction schedules. A cloud provider, acting as a third-party custodian, should follow those contractual requirements rather than determine them.

CISM: Certified Information Security ManagerDemo

AstroTutor

Notes

Readiness

QuestionQ262

Community Discussion