CISM: Certified Information Security Manager

By Isaca · Question Mode

QuestionQ59

VerifiedInformation Security Risk Management

A finance department director has chosen to outsource the organization’s budget application and has identified possible providers. Which of the following actions should the information security manager initiate FIRST?

Explanation

Required security controls must be defined before prospective service providers can be assessed. They establish the security criteria used to evaluate hosting-environment audit reports, disaster recovery plans, and the allocation of responsibilities between the organization and the provider.

Community Discussion

No comments yet. Be the first to start the discussion!