CRISC: Certified in Risk and Information Systems ControlDemo

Question

An organization has outsourced its customer-management database to an external service provider. Who is accountable for ensuring customer data privacy?

A The organization's business process owner
B The organization's information security manager
C The organization's vendor management officer
D The vendor's risk manager

Explanation

Outsourcing processing does not transfer the organization’s accountability for the privacy of customer data. The business process owner is accountable for the privacy requirements of the customer-management process, while security and vendor-management roles provide supporting oversight and controls.

CRISC: Certified in Risk and Information Systems ControlDemo

AstroTutor

Notes

Readiness

QuestionQ880

Community Discussion