CRISC: Certified in Risk and Information Systems ControlDemo

Question

An organization has outsourced its IT security management function to an external service provider. Under this arrangement, the BEST party to own the IT security controls is the:

A organization's risk function
B service provider's audit function
C organization's IT management
D service provider's IT security function

Explanation

IT security-control ownership remains with the organization’s IT management because accountability for the organization’s security and control environment cannot be outsourced. The service provider may operate controls on the organization’s behalf, subject to the organization’s governance and oversight.

CRISC: Certified in Risk and Information Systems ControlDemo

AstroTutor

Notes

Readiness

QuestionQ1547

Community Discussion